Full Report
Discover how detection teams can split EDR-killer attacks into four distinct behavior hunts to catch BYOVD and driverless threats before ransomware fires.
Analysis Summary
# Tool/Technique: EDR Killer Attack Categories (BYOVD, Bring-Your-Own-Installer, Admin-to-Kernel, Driverless Suspension)
## Overview
This SentinelOne article argues that "EDR killer" describes four distinct attack techniques, each with its own footprint. Detection teams that write one rule for the whole category miss the others. The article gives a detection taxonomy and a hunt for each technique. The first and most developed is **Bring-Your-Own-Vulnerable-Driver (BYOVD)**, which loads a signed but flawed kernel driver and uses it to terminate security processes. The article's stated goal is to turn this category into specific, hunt-able behavior.
## Technical Details
- Type: Technique (with associated malware and tools, including the POORTRY driver and STONESTOP loader)
- Platform: Windows
- Capabilities: Kernel-level process termination through a signed driver; installer/upgrade abuse to replace the agent; elevated-session-to-kernel escalation; user-mode agent suspension or telemetry blocking with no driver
- First Seen: Not stated for the category. The article is dated Oct 19, 2026. It references POORTRY activity and advisory ADV220005, and cites reporting from 2024 to 2026.
## MITRE ATT&CK Mapping
*Mappings below are inferred from the article's descriptions and were not listed in the source.*
- TA0005 - Defense Evasion
- T1562.001 - Impair Defenses: Disable or Modify Tools
- T1562.004 - Impair Defenses: Disable or Modify System Firewall (WFP filter changes)
- T1562.006 - Impair Defenses: Indicator Blocking (telemetry-egress blocking)
- T1553.002 - Subvert Trust Controls: Code Signing (signed-but-flawed drivers)
- TA0004 - Privilege Escalation
- T1068 - Exploitation for Privilege Escalation (admin-to-kernel)
- TA0003 - Persistence
- T1543.003 - Create or Modify System Process: Windows Service (driver service creation)
## Functionality
### Core Capabilities
- **BYOVD:** Loads a signed, vulnerable driver and issues kernel process-termination IOCTLs. Public catalogs such as LOLDrivers list thousands of such drivers, many reachable without admin rights.
- **Bring-your-own-installer:** Abuses a trusted installer or upgrade path to swap out or reinstall the EDR agent. This produces no driver-load event.
- **Admin-to-kernel:** Uses a known gap to move from an elevated session to Ring 0 and remove kernel callbacks.
- **Driverless suspension:** Freezes the agent from user space or blocks its telemetry egress (for example, with WFP filters) without loading a driver.
### Advanced Features
- The article cites real-world tooling in use: POORTRY (kernel driver with process-kill IOCTL, valid WHQL signatures later revoked under ADV220005), STONESTOP (loader), EDR-Freeze (suspends via Windows WER), and EDRSilencer (blocks EDR network traffic with WFP).
- Reported operators include Qilin, Akira, and RansomHub. The article's references point to Qilin EDR-killer infection chains, Akira SonicWall campaign driver use, and RansomHub's EDR-killing tool.
- A single driver-load rule is blind to the installer and driverless paths, which is the coverage gap the article highlights.
## Indicators of Compromise
- File Hashes: Not provided in the visible article text.
- File Names: Not provided in the visible article text. POORTRY and STONESTOP are named as families.
- Registry Keys: Not provided.
- Network Indicators: None are listed in the visible text. Reference links include loldrivers.io, which is a public catalog and not an IOC.
- Behavioral Indicators:
- Driver loads with a SignatureStatus other than Valid
- Driver loads for a hash, signer, or version not previously seen on the host
- Service creation following a driver load
- Agent upgrade or reinstall events outside change windows
- Loss of expected kernel-callback telemetry
- Process suspension or WFP filter changes with no driver load
- Gaps in agent heartbeat
## Associated Threat Actors
- Qilin (referenced EDR-killer driver abuse, 2026)
- Akira (referenced SonicWall campaign driver use, 2025)
- RansomHub (developed an EDR-killing tool, 2024)
## Detection Methods
- **Signature and trust-based (driver load):** Sysmon Event ID 6 logs ImageLoaded, Hashes, Signed, Signature, and SignatureStatus. Alert on any status other than Valid. Build a first-seen rule on driver hash, signer, or version. Expect false positives from patch cycles and plan a tuning period and allowlist.
- **Service creation:** System Event ID 7045 to correlate with driver loads.
- **Installer/upgrade:** Alert on agent install or upgrade events outside a change-window baseline.
- **Kernel integrity:** Use EDR kernel-callback integrity reporting to catch callback removal.
- **Driverless:** Monitor process-state events, WFP filter changes, and agent heartbeat.
- **Behavioral:** The article urges hunting suspicious behavior over specific hashes or file names.
- YARA rules: Not provided in the visible text.
## Mitigation Strategies
- *Not fully covered in the visible text. The following are standard recommendations:*
- Enable the Microsoft vulnerable driver blocklist and keep it current.
- Enforce HVCI (memory integrity) and WDAC driver policies to restrict driver loads.
- Revoke or block known-vulnerable drivers (for example, POORTRY-derived drivers).
- Restrict local admin rights to limit access to the admin-to-kernel path.
- Protect agent update and install channels and require change-window approval.
- Monitor agent health with heartbeat alerting so that silent kills are noticed.
## Related Tools/Techniques
- POORTRY and STONESTOP (signed-driver kill primitive and loader)
- LOLDrivers (catalog of vulnerable signed drivers)
- EDR-Freeze (WER-based user-mode suspension)
- EDRSilencer (WFP-based telemetry blocking)
- Qilin EDR Killer and RansomHub EDR-killer tooling
- Sysmon Community Guide: Driver Loading (TrustedSec)
*Note: The source text is truncated, so the full hunt logic for the later sections may include details not captured here.*