EnCase BYOVD - EDR Killer Execution Sequence (T1204.002)

Ibrahim Saud@tektrix

•updated Jun 23, 2026•0•0•3

This rule detects the execution of a user-mode EDR Killer executable from common temporary or public directories (Temp or Public) immediately preceding the creation of a known ransomware or payload file (executable, MSI, batch, or PowerShell script). The detection logic looks for process command lines containing keywords like '-kill', '-bypass', or '-edr' for the EDR Killer, followed by a file creation event within a 5-minute window on the same device.