WinDefCtl IFEO Debugger tampering and kvckiller.sys driver deployment

Ethan Andrews@eandrews

•updated Jul 9, 2026•8•0•14

This rule detects tampering with Microsoft Defender by monitoring registry modifications to Image File Execution Options (IFEO) used to attach debuggers to security processes. It also detects the dropping of the 'kvckiller.sys' kernel driver into System32\drivers, which is associated with disabling security software at the kernel level, and the execution of processes containing 'wsftprm' in the command line.