EnCase BYOVD - EDR Telemetry Blackout (T1562)

Ibrahim Saud@tektrix

•updated Jun 23, 2026•0•0•1

Identifies the EDR Killer successfully removing driver callbacks or notify routines in kernel memory by detecting a sudden cessation of telemetry following the driver load of 'EEDbg.sys'. This rule correlates driver load events with subsequent telemetry drops from the same device.