EDR-Redir, as described in the recent report, is a Windows-based tool (also referred to as EDRStartupHinder) designed to block antivirus and EDR services during system startup on Windows 11 with 25H2 Defender.
Overview
EDR-Redir, as described in the recent report, is a Windows-based tool (also referred to as EDRStartupHinder) designed to block antivirus and EDR services during system startup on Windows 11 with 25H2 Defender. By preventing key security services from initializing, it aims to hinder endpoint detection and response capabilities, enabling stealthy or offensive operations. This makes it a notable boot-time defense-evasion tool in cybersecurity contexts.
Related Threat Clusters
-
EDRStartupHinder Tool Blocks Antivirus and EDR at Windows 11 25H2 Startup
A new tool named EDRStartupHinder has been unveiled by security researcher TwoSevenOneT. This tool is designed to block antivirus and EDR services at startup on Windows 11 25H2 by redirecting critical System32 DLLs,…
3 articles · Updated January 12, 2026
Recent Intelligence Reports
- New EDRStartupHinder Tool blocks antivirus and EDR services at startup on Windows 11 25H2 Defender — Cybersecuritynews · January 12, 2026