Backstab

Backstab is a Windows tool for terminating antimalware-protected processes by directing the Process Explorer driver to close their handles. The upstream README describes a driver-backed command-line interface: it enumerates and closes protected-process handles, drops and loads the driver, creates and deletes a temporary service-registry key, enables SeDebugPrivilege, and unloads the driver when finished. The README assumes local administrator credentials. This destructive defense-evasion behavior can disable security controls or destabilize the host; a Microsoft signature on the driver does not establish that using it is safe.