Full Report
Discover how Bring Your Own Vulnerable Driver (BYOVD) tactics evolved from lone-operator tricks into a commercialized, tiered EDR-killer service economy.
Analysis Summary
# Tool/Technique: Bring Your Own Vulnerable Driver (BYOVD) / EDR Killers
## Overview
Bring Your Own Vulnerable Driver (BYOVD) is a technique where attackers with administrative privileges load a legitimate but vulnerable signed kernel driver onto a target system. Once loaded, the attacker exploits a known vulnerability in the driver (often a memory corruption or insufficient access control flaw) to gain kernel-mode execution. In the current threat landscape, this technique has evolved from a manual exploit into a commercialized "EDR-killer" service economy, where specialized tools are developed, versioned, and sold to disable Endpoint Detection and Response (EDR) agents.
## Technical Details
- **Type**: Technique (leveraging legitimate Tools for Malicious Use)
- **Platform**: Windows (primarily)
- **Capabilities**: Kernel-mode privilege escalation, security software termination, process protection removal (PPL), and credential theft.
- **First Seen**: Technique has existed for years; commercialized "EDR-killer" frameworks became prominent circa 2023–2026.
## MITRE ATT&CK Mapping
- **[TA0005 - Defense Evasion]**
- **[T1562.001 - Impair Defenses: Disable or Modify Tools]**
- **[T1014 - Rootkit]**
- **[TA0004 - Privilege Escalation]**
- **[T1068 - Exploitation for Privilege Escalation]**
## Functionality
### Core Capabilities
- **Kernel Access**: Abuses validly signed drivers to execute code in Ring 0.
- **Process Termination**: Hunts for and terminates over 400 unique processes associated with roughly 48 security products.
- **Impersonation**: Variants often rename themselves or mimic legitimate security software (e.g., Safetica, Zemana) to blend into the process list.
- **Driver Abstraction**: Modern kits (like the "hastalamuerte" framework) provide a compatibility matrix, allowing affiliates to swap drivers if one is blocked by Microsoft’s driver blocklist.
### Advanced Features
- **Commercial Support**: Ransomware operators (RaaS) maintain these tools as "products" with regular updates and support for affiliates.
- **Broad Targeting**: Tools like the Qilin-linked killer target over 300 different EDR-specific drivers simultaneously.
- **Bundled Payloads**: Often packaged with secondary tools like **OxideHarvest** (credential stealer).
## Indicators of Compromise
- **File Names**: `Terminator.exe`, `AuKill.exe`, `AvNeutralizer.exe`, `HexKiller`, `ThrottleBlood`, `HavocKiller`.
- **Vulnerable Drivers (Commonly Abused)**:
- `zam64.sys` / `zam32.sys` (Zemana)
- `procexp.sys` (Process Explorer)
- Drivers from: NSecsoft, Qihoo 360, Safetica, TTD.
- **Behavioral Indicators**:
- Loading of known vulnerable drivers not associated with the environment's standard software stack.
- Abrupt cessation of EDR/AV service heartbeats.
- Presence of `SeLoadDriverPrivilege` being exercised by non-standard processes.
## Associated Threat Actors
- **hastalamuerte** (RaaS operator)
- **FIN7** (Developers of AvNeutralizer/AuKill)
- **Spyboy** (Creator of Terminator)
- **Ransomware Groups**: Black Basta, AvosLocker, MedusaLocker, BlackCat (ALPHV), Trigona, LockBit, Qilin, RansomHub.
## Detection Methods
- **Signature-based detection**: Tracking hashes of known "EDR Killer" binaries and the specific vulnerable drivers they carry.
- **Behavioral detection**:
- Monitoring for `DeviceIoControl` calls to known vulnerable drivers.
- Alerting on the loading of drivers with known CVEs (e.g., CVE-2025-68947).
- **YARA rules**: Targeting the internal strings of frameworks that list hundreds of security process names.
## Mitigation Strategies
- **Microsoft Vulnerable Driver Blocklist**: Ensure Windows "Memory Integrity" (HVCI) and the Microsoft driver blocklist are enabled.
- **Hardening**: Use Windows Defender Application Control (WDAC) to restrict driver loading to a strict "allow-list."
- **Least Privilege**: Strictly control administrative rights, as loading a driver typically requires `SeLoadDriverPrivilege`.
- **EDR Protection**: Use EDR solutions with "Tamper Protection" that can survive kernel-level attempts to unhook or terminate them.
## Related Tools/Techniques
- **AvNeutralizer / AuKill**: Sophisticated bypass tool sold by FIN7.
- **Terminator**: One of the first widely marketed BYOVD tools on Russian forums.
- **OxideHarvest**: Credential stealer often bundled with EDR-killer suites.
- **LSA Protection Bypass**: Techniques often used in tandem with BYOVD to dump credentials.