The Gentlemen EDRKiller/WarsawKiller Execution or wsftprm.sys Load

Arnold Chan@slaz

•updated Sep 21, 2026•0•0•2

This rule detects the execution, file presence, or driver loading associated with 'EDRKiller' and 'WarsawKiller', which are malicious tools used to terminate or disable endpoint security products.