Malicious Driver Installation for EDR Evasion
Summary Sophisticated EDR (Endpoint Detection and Response) killer tools are increasingly being used by various ransomware groups to disable security solutions, allowing them to operate undetected during multi-stage attacks. These tools, often packed with services like HeartCrypt, leverage compromised code-signing certificates and vulnerable drivers to gain kernel-level access and terminate security processes. What's New A significant new finding is the widespread adoption and apparent sharing of these EDR killer tools, often customized and packed with HeartCrypt, across numerous competing ransomware groups including RansomHub, Blacksuit, Medusa, Qilin, Dragonforce, Crytox, Lynx, and INC. This suggests a concerning trend of technical knowledge transfer and tool sharing within the ransomware ecosystem, making these attacks more pervasive and challenging to defend against. Actionable Threat Data T1562.001 - Impair Defenses: Disable or Modify Tools: Monitor for the creation of new services with randomly generated five-character names, especially those associated with .sys files, as these are indicative of malicious driver installation for EDR evasion. T1036.005 - Masquerading: Match Legitimate Name or Location: Look for executables that masquerade as legitimate software (e.g., by injecting malicious code into legitimate utilities like Beyond Compare) and attempt to load drivers signed with revoked or expired certificates from entities like "Changsha Hengxiang Information Technology Co., Ltd." or "Fuzhou Dingxin Trade Co., Ltd.". T1562.001 - Impair Defenses: Disable or Modify Tools: Detect attempts to terminate security-related processes such as MsMpEng.exe, SophosHealth.exe, SAVService.exe, sophosui.exe, sepwscsvc64Exe, sepagentExe, SophosOsqueryExtension.exe, SophosNetFilter.exe, SophosScanCoordinator.exe, SophosUpdate.exe, HitmanPro.Alert.exe, HitmanPro.exe, HmpschedExe, mpcmdrunExe, and NissrvExe. T1055 - Process Injection: Identify instances of process hollowing
Sigma
