Exploit for MonProcessEX.sys - kernel driver abuse to terminate protected processes
MonProcessEX.sys is a HONOR MagicAnimation and HONOR PCManager signed kernel driver that exposes IOCTL 0x22400C to reach ZwTerminateProcess. The device is accessible to LocalSystem and local administrators, and the process-termination path does not verify the caller, allowing an administrator-accessible client to terminate arbitrary user-mode processes except PID 0 and PID 4 from kernel mode.
sc.exe create MonProcessEX binPath=C:\windows\temp\MonProcessEX.sys type=kernel && sc.exe start MonProcessEX
MonProcessEX.exe <process_name>
MonProcessEX.exe MsMpEng.exe
This exploit abuses MonProcessEX.sys, a legitimately signed driver, to terminate any process from kernel-level, allowing attackers to kill EDR/AV solutions (Windows Defender, CrowdStrike, SentinelOne) that are protected against userland termination. Since the driver is signed, it bypasses Driver Signature Enforcement (DSE), making exploitation trivial. Once loaded, any local user can disable security defenses and execute malware undetected.
This tool is for educational and research purposes only. Use it only on systems you own or have explicit permission to test. The author is not responsible for any misuse or damage caused by this program.
QuimeraX Intelligence is an advanced EASM and Cyber Threat Intelligence platform specializing in identifying critical vulnerabilities in complex systems. The platform proactively monitors, detects, and alerts clients about security threats, ensuring transparency and rapid response to potential risks. Clients receive immediate notifications and comprehensive reports if their systems are found vulnerable, enabling them to take protective action. learn more
Hakai Security is a cybersecurity company founded by security professionals, committed to technical excellence. We offer tailored security solutions including advanced penetration testing, realistic Red Team simulations, and secure development practices to proactively protect our clients' assets from evolving cyber threats.