BYOVD and EDR-Killer Hunting: Four Distinct Techniques Detection Teams Should Cover Separately Before Ransomware Deployment

Linha do tempo

1. sentinelone.com ↗ · pub. 19/10/2026 10:00 · coletado 19/10 17:57 primeiro registro

   BYOVD and EDR-Killer Hunting: Four Distinct Techniques Detection Teams Should Cover Separately Before Ransomware Deployment

   ler a análise desta fonte ocultar

   SentinelOne argues that "EDR killer" covers four different techniques, and a single driver-load rule leaves blind spots. The four are bring-your-own-vulnerable-driver (BYOVD), bring-your-own-installer, admin-to-kernel, and driverless suspension. The article gives hunt logic for each and recommends rolling them out in order of signal quality. It cites commoditized tooling such as AvNeutralizer/AuKill (attributed to FIN7, sold for $4,000-$15,000 and adopted by multiple ransomware crews) and EDRKillShifter (offered to RansomHub affiliates). It also stresses that an EDR kill usually comes minutes before ransomware encryption, which makes it a high-confidence early-warning signal. The piece is a vendor blog and includes promotion of SentinelOne Purple AI and Wayfinder.

   Technical Details

   • BYOVD: Sysmon Event ID 6 (driver load) with a signature status other than Valid, plus a first-seen hash/signer/version rule. Correlate the chain sc.exe service create (Sysmon Event ID 1) → System Event 7045 → Event ID 6 → DeviceIoControl IOCTL → callback removal and security-process termination. Services masquerading as Windows updates ("KB" names) tied to unsigned or first-seen drivers are a high-confidence pairing. The chain is documented in Kasseika, BlackByte and RansomHub intrusions.
   • POORTRY/STONESTOP: the signed POORTRY driver received a process-kill IOCTL. Its WHQL signatures were later revoked under ADV220005.
   • Admin-to-kernel: Qilin loaded rwdrv.sys (raw memory read/write) and hlpdrv.sys (kernel-callback manipulation), removing EDR callbacks across more than 300 products. The same pairing appears in Akira. Hunt for loss of EDR kernel-callback integrity telemetry and for fixed-interval agent re-kill loops, where the driver calls ZwTerminateProcess and bypasses PPL.
   • Bring-your-own-installer: abuse of a trusted installer or upgrade path to replace the agent. It leaves no driver-load event, so hunt for agent install, upgrade or uninstall outside change windows.
   • Driverless suspension: EDR-Freeze races the WerFaultSecure crash handler to suspend the EDR process. EDRSilencer uses WFP filters to block telemetry of roughly 16 products. Hunt for process-suspension state changes and new WFP filters matching agent egress destinations.
   • Other signals: Windows Event ID 7031 scoped to security services, heartbeat loss, and absence of expected telemetry. Network, identity and cloud logs survive the kill and act as independent witnesses.
   • Caveat: the ASR rule blocks a vulnerable driver from being written to disk but does not stop one already present from loading. CodeIntegrity Event ID 3099 only confirms the blocklist policy is applied.

   Remediation

   • Enable Sysmon Event ID 6 logging and deploy the untrusted-signature and first-seen driver rules. Plan a tuning period and allowlist first.
   • Add the service-create → driver-load → IOCTL/termination correlation.
   • Add a dedicated Event ID 7031 rule for security services and an agent-health heartbeat monitor.
   • Build an inventory of sanctioned change windows and package signers before enabling the installer and absence-of-signal hunts.
   • Route network, identity and cloud telemetry into the same hunt, and apply the driver blocklist policy while recognizing it does not unload drivers already loaded.