New malware surfaces to terminate NGAVs/EDRs/XDRs

ThreatLocker reports on an unverified claim of an executable that can disable tamper protection and terminate EDR/XDR/AV agents across numerous vendors (e.g., Microsoft Defender, CrowdStrike, SentinelOne), and emphasizes that its application allowlisting and Ringfencing can block such unauthorized executables; it advises maintaining strict allowlists within a zero-trust posture while noting the source cannot be confirmed.