EDR Killers - Ransomware BYOVD Defense Evasion
Detects the full kill-chain used by modern ransomware operators (RansomHub, LockBit affiliates, BlackCat/ALPHV, FIN7) who deploy EDR killers (EDRKillShifter, AvNeutralizer/AuKill, Terminator, RealBlindingEDR, GhostDriver/Poortry, Backstab) in the pre-encryption phase. These tools use the BYOVD (Bring Your Own Vulnerable Driver) technique — loading a legitimately-signed but vulnerable kernel driver (rtcore64.sys, gdrv.sys, truesight.sys, dbutil_2_3.sys, mhyprot2.sys, procexp152.sys, aswarpot.sys, zam64.sys) as a kernel service, then abusing its IOCTLs to terminate protected EDR processes from kernel space, bypassing PPL. This pack contains 10 queries covering vulnerable driver loads, drivers dropped to user-writable paths, kernel service creation, known EDR-killer binaries, Defender/EDR service tampering, mass security-process termination bursts, unsigned kernel loads, registry-based Defender tampering, full driver→service→kill chain correlation within 1h, and a hash-free behavioural catch-all (unsigned loader → sc.exe create kernel service within 60s).
Microsoft Sentinel (KQL)
