BYOVD - EDR Killer Process Execution (T1562.001)
Correlates the loading of a .sys driver with the subsequent rapid termination of security, EDR, and AV processes via the EDR Killer utility.
Microsoft Sentinel (KQL)
Correlates the loading of a .sys driver with the subsequent rapid termination of security, EDR, and AV processes via the EDR Killer utility.
Already have an account?