Warsaw is a lightweight tool that neutralizes endpoint security products on Windows machines. It disables EDR and antivirus services, then continuously terminates their processes — even if they try to restart themselves.
One executable. Run as admin. That's it.
- Loads a kernel driver — embedded inside the executable, extracted and loaded automatically at runtime
- Disables security services — stops and disables 80+ Windows services across every major vendor
- Kills protected processes — uses the kernel driver to terminate processes that can't be killed from usermode
- Keeps them dead — polls continuously and re-kills anything that respawns
Covers 200+ process signatures including CrowdStrike, SentinelOne, Defender, Sophos, ESET, Kaspersky, Bitdefender, Palo Alto, Trellix, Elastic, Rapid7, Avast, AVG, Norton, Sysmon, Tanium, Huntress, Cylance, HarfangLab, and many more. Run warsaw.exe --list to see the full list.
warsaw.exe :: kills everything it recognizes
warsaw.exe --dry :: scan only — shows what it would kill without touching anything
warsaw.exe --list :: print all 200+ signatures
| Flag | Description |
|---|---|
--target <name> |
Only hunt processes matching a specific name |
--fast |
Poll every 100ms instead of the default 800ms |
--delay <ms> |
Set a custom poll interval |
--no-disable |
Skip service disabling, only kill processes |
--dry |
Scan only — no termination, no driver loaded |
--list |
Print all known signatures and exit |
revert.exe undoes everything — re-enables all disabled services and cleans up the driver. Run as admin.
revert.exe
Requirements: Visual Studio 2017/2019/2022 with the MSVC C/C++ toolset installed.
- Place your signed driver as
wsftprm.sysin this directory - Run
_b.cmd
_b.cmd
The build script converts wsftprm.sys into a C byte array (driver_blob.h) automatically, then compiles both warsaw.exe and revert.exe. You never need to commit or manage driver_blob.h — it's regenerated every build.
If wsftprm.sys is missing, the build fails with a clear error.
The .sys file is not included in this repo. You need a valid signed kernel driver (SHA-1 or SHA-256 certificate). Systems running Smart App Control or strict HVCI may block driver loading.
For authorized security testing only.