EDR-Redir

Tool

Threat entity extracted from intelligence sources

Frequency

occurrences

First Seen

January 12, 2026

Last Seen

January 12, 2026

API

EDR-Redir, as described in the recent report, is a Windows-based tool (also referred to as EDRStartupHinder) designed to block antivirus and EDR services during system startup on Windows 11 with 25H2 Defender.

Overview

Recent Events

Relationships

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Related Clusters (1)

EDRStartupHinder Tool Blocks Antivirus and EDR at Windows 11 25H2 Startup

Jan 12·3 sources

Related Entities

Malware Windows 11 Windows Defender EDR-Freeze EDRStartupHinder

EDR-Redir

Overview

Recent Events

Profile

Attack Types

Platforms

Relationships

Related Clusters (1)

EDRStartupHinder Tool Blocks Antivirus and EDR at Windows 11 25H2 Startup

Related Articles (1)

New EDRStartupHinder Tool blocks antivirus and EDR services at startup on Windows 11 25H2 Defender

Related Entities