{"repo":"zero2504/Fairy-Law","free":true,"listed":false,"github":"https://github.com/zero2504/Fairy-Law","clone":"git clone https://github.com/zero2504/Fairy-Law.git","description":"Fairy Law - Compromise or disable EDR security solutions","language":"C++","stars":80,"topics":["edr-bypass","edr-evasion","internals","malware-research","powershell","windows-11"],"license":"MIT","category":"analytics","readme_excerpt":"Fairy-Law Fairy Law – Abusing MicrosoftSignedOnly to Impair EDR Full technical report available on the Orange Cyberdefense Blog. (Link for the technical report) --- Overview Endpoint Detection & Response (EDR) solutions typically combine kernel-mode components with user-mode components such as monitoring modules, support libraries, and telemetry collectors. These user-mode components are often delivered as regular DLLs signed by the vendor or a third-party CA. Windows provides a mitigation policy called MicrosoftSignedOnly , which enforces that a process may only load DLLs that are signed by Microsoft. When this policy is enabled system-wide, the operating system rejects all libraries that are not Microsoft-signed. This includes EDR components, even if they are properly signed by the vendor. As a result, many EDR agents cannot initialize and fail completely during startup after reboot. --- Why the Name “Fairy Law” The technique name “Fairy Law” originates from the spell in the anime Fairy Tail . In the series, the spell affects only those the caster recognises as enemies and leaves allies unharmed. This reflects how MicrosoftSignedOnly behaves. Windows treats Microsoft-signed binaries as trusted allies, while all other binaries, including legitimate vendor DLLs, are treated as hostile and are prevented from loading. The system itself decides what is allowed to run and rejects everything else instantly. --- Core Idea “Fairy Law” The technique enables the MicrosoftSignedOnly po","default_branch":null,"files":null,"tree":[],"storefront":"/r/zero2504","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/zero2504/Fairy-Law/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}