Qilin EDR Killer Component File Write

Taylor Parizo@axelarator

•updated Apr 2, 2026•15•1•189

Detects the creation of specific executable files (rwdrv.sys, hlpdrv.sys, msimg32.dll) associated with the Qilin EDR killer malware. This rule specifically looks for these files being written to disk, excluding legitimate writes of msimg32.dll to standard Windows system directories to reduce false positives.