EDR Killer Malicious Driver Creation
Detects the creation of malicious drivers used by an EDR Killer tool. This tool is leveraged by numerous ransomware groups, including RansomHub, Blacksuit, Medusa, and INC, to disable security products before deploying ransomware. The detection is based on known malicious file hashes and drivers signed with specific, known-abused certificates.
Sigma
