BYOVD Driver-Assisted EDR Process Termination (T1562.001)
This rule detects potential tampering with security agents by monitoring for the load of suspicious drivers (Sysmon Event ID 6) immediately followed by the termination of known security software processes (Sysmon Event ID 5) or signs of security service disability (Windows Security Center 5004) or unauthorized raw disk access (Sysmon Event ID 9). This behavior is often indicative of an adversary attempting to bypass EDR or AV solutions by loading a malicious kernel driver to blind them.
Splunk (SPL)
