Full Report
Threat actors are actively targeting your security tools. Learn how threat actors disable antivirus and EDR through vulnerable drivers, tampering attacks, and malicious firewall rules, and how Huntress detects.
Analysis Summary
# Tool/Technique: Impairing and Disabling EDR (Defense Evasion)
## Overview
This suite of techniques involves adversaries actively targeting, silencing, or terminating security software (AV, EDR, and EPP) to create "dark zones." By neutralizing these tools, attackers can move laterally and deploy payloads like ransomware without generating alerts or telemetry for security teams.
## Technical Details
- **Type:** Technique / Attack Framework
- **Platform:** Windows (primarily), ESXi (Virtualization)
- **Capabilities:** Kernel-mode execution, process termination, communication blocking, and security configuration tampering.
- **First Seen:** Ongoing; BYOVD techniques surged in popularity circa 2021-2024.
## MITRE ATT&CK Mapping
- **TA0005 - Defense Evasion**
- **T1562 - Impair Defenses**
- **T1562.001 - Disable or Modify Tools**
- **T1562.004 - Disable or Modify System Firewall**
- **T1562.009 - Safe Mode Boot**
- **T1068 - Exploitation for Privilege Escalation** (via BYOVD)
## Functionality
### Core Capabilities
- **EDR Silencing:** Utilizing Windows Firewall or the Windows Filtering Platform (WFP) to create rules that block an EDR agent’s outbound communication to its cloud console.
- **Exclusion Manipulation:** Adding broad exclusions (e.g., excluding the entire `C:\` or `C:\Windows` drives) to Microsoft Defender to prevent it from scanning malicious directories.
- **Agent Uninstallation:** Directly removing security software using administrative privileges or compromised credentials.
### Advanced Features
- **Bring Your Own Vulnerable Driver (BYOVD):** Loading a legitimate, signed, but vulnerable third-party driver (e.g., EnCase forensic drivers, gaming drivers) to gain kernel-mode access. This allows attackers to bypass "Protected Processes" and unhook security monitoring.
- **Safe Mode Exploitation:** Forcing a system reboot into Safe Mode, where many EDR/AV drivers are not configured to load, allowing for unimpeded malware execution.
- **Hypervisor Escape:** Targeting ESXi hypervisors to break out of guest VMs and compromise the underlying infrastructure.
## Indicators of Compromise
- **File Names:** `EDRSandblast.exe`, `EDRSilencer.exe`.
- **Registry Keys:**
- `HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions` (Unexpected entries).
- `HKLM\System\CurrentControlSet\Control\SafeBoot` (Modifications to force reboots).
- **Behavioral Indicators:**
- Unexpected loading of signed drivers not associated with the system's hardware.
- Commands like `netsh advfirewall` or `PowerShell` scripts modifying WFP filters.
- Mass uninstallation events across multiple endpoints.
- Large-scale directory exclusions applied via GPO or PowerShell.
## Associated Threat Actors
- **Akira Ransomware** (Known for Safe Mode reboots).
- **Affiliates using SonicWall vulnerabilities** (Linked to EnCase driver BYOVD attacks).
- General Ransomware-as-a-Service (RaaS) groups.
## Detection Methods
- **Behavioral Detection:** Monitoring for unauthorized modifications to security software registry keys or firewall rules.
- **Kernel Monitoring:** Auditing driver load events (Event ID 6) and cross-referencing against a blocklist of known vulnerable drivers (e.g., LOLDrivers project).
- **Communication Heartbeats:** Alerting when an EDR agent stops communicating with the management console while the host heartbeat remains active.
## Mitigation Strategies
- **Driver Sandboxing/Blocking:** Enable Microsoft’s "Vulnerable Driver Blocklist" and utilize HVCI (Memory Integrity) to prevent unsigned or known-vulnerable drivers from loading.
- **Tamper Protection:** Ensure EDR "Tamper Protection" features are enabled to prevent the termination of security processes even by administrators.
- **Least Privilege:** Restrict administrative rights to prevent unauthorized uninstallation of security agents or modification of firewall rules.
## Related Tools/Techniques
- **EDRSandblast:** A tool for weaponizing BYOVD to strip EDR callbacks.
- **EDRSilencer:** A tool for automating the blocking of EDR traffic.
- **Safe Mode Booting:** A technique used to circumvent security stacks that don't start in minimal boot environments.