Reverse Engineering PoisonX Driver

I reverse engineer PoisonX, a signed Windows kernel-mode rootkit used as a BYOVD tool in targeted campaigns against EDR and PPL defenses, and break down how it works.

Watch the video

Source

  • (Medium, 2026), @jehadbudagga https://medium.com/@jehadbudagga/reverse-engineering-a-0day-used-against-crowdstrike-edr-a5ea1fbe3fd4