← All Chokepoints CRITICAL

EDR Bypass Techniques

Defense Evasion T1562.001 T1562.006 T1055.001 T1014 Detection difficulty: HIGH Prevalence: HIGH

Adversaries impair or neutralize EDR/AV products before executing their primary payload to prevent detection and response. Techniques span from user-mode API unhooking (removing hooks EDRs inject into ntdll.dll) through kernel-level driver exploitation (BYOVD — Bring Your Own Vulnerable Driver) to direct process termination of security tools. Despite the diversity of techniques, the chokepoint is invariant: admin/SYSTEM privileges are always required, and the bypass mechanism always produces a kernel-observable artifact — a driver load event, a VirtualProtect call against protected system memory, or direct termination of a security process. As of 2024, approximately 48% of high-severity ransomware attacks incorporate purpose-built EDR disablement (Cisco Talos). BYOVD has become a de facto phase in major ransomware deployment chains.

By @iimp0ster · Updated 2026-03-12 · View source YAML

Prerequisites (Environmental)

  • ✓ Admin or SYSTEM privileges on target system (required without exception)
  • ✓ Execution capability on target (process creation for bypass tool)
  • ✓ {"For BYOVD"=>"a vulnerable signed driver loadable via NtLoadDriver or SCM"}
  • ✓ {"For kernel callback removal"=>"ability to read/write kernel memory (via vulnerable driver)"}
  • ✓ {"For user-mode techniques"=>"VirtualProtect/NtProtectVirtualMemory access to target DLL memory"}
  • ✓ Target EDR must be using one of the impaired mechanisms (user-mode hooks, ETW, kernel callbacks)

Variations

Tools and methods that exploit this chokepoint — the list grows; the chokepoint doesn't change:

BYOVD — EDRKillShifter Active
2024-Q3
Source →
BYOVD — Terminator (Spyboy) Active
2023-Q1
Source →
BYOVD — AuKill Active
2023-Q1
BYOVD — POORTRY / STONESTOP Active
2024-Q1
Kernel Callback Removal (EDRSandblast) Active
2022-Q1
Source →
PPL Abuse (PPLKiller / PPLdump) Active
2020-Q4
User-mode Unhooking (ntdll Fresh Copy) Active
2020-Q1
Direct and Indirect Syscalls (SysWhispers, Hell's Gate, Halo's Gate) Active
2019-Q3
ETW Patching (EtwEventWrite) Active
2020-Q2
AMSI Bypass (AmsiScanBuffer Patch) Declining
2019-Q1
EDRSilencer Active
2024-Q2
Module Stomping / Reflective DLL Injection Active
2014-Q1
Heaven's Gate (WoW64 Evasion) Declining
2020-Q1
BlackSanta EDR Killer Active
2026-Q1

Detection Strategy

Build detections iteratively. Start broad to understand your baseline, then tighten to production-ready.

Goal: Identify all kernel driver load events in the environment, focusing on non-Microsoft and recently signed drivers

Log Sources

  • Sysmon Event ID 6 (Driver Loaded)
  • Windows Security Event ID 4688 (Process Creation)
  • Windows System Event ID 7045 (Service Installed)

FP Rate: High

Use Case: Build baseline of all drivers loaded in the environment; identify gaps in driver allowlisting; compare against Microsoft Vulnerable Driver Blocklist

Detection Logic

Event ID: 6 (Driver Loaded) Filter: Signature NOT from Microsoft OR SignatureStatus != Valid OR: Driver signed within last 90 days OR: Driver hash matches Microsoft Vulnerable Driver Blocklist
Sigma Rule — Research Level
View on GitHub Download 
title: EDR Bypass — All Non-Microsoft Kernel Driver Loads (Research Baseline)
id: a1f3c2e4-9b7d-4e6a-8c0f-2d5b7e9f1a3c
status: experimental
description: >
  Broad visibility rule capturing all kernel driver load events where the driver
  is unsigned, has an invalid/revoked signature, or is signed by a non-Microsoft
  publisher. Designed as a baselining rule to map the complete driver landscape in
  your environment before tuning toward BYOVD-specific hunt and analyst rules.
  BYOVD (Bring Your Own Vulnerable Driver) is the primary kernel-level EDR bypass
  technique — used in 48% of high-severity 2024 ransomware attacks — and always
  requires loading a kernel driver as a prerequisite. This rule captures the
  invariant: Admin/SYSTEM privileges → kernel driver loaded → EDR telemetry
  impaired. High false positive rate expected; purpose is environmental baselining,
  not alerting.
references:
  - https://attack.mitre.org/techniques/T1562/001/
  - https://attack.mitre.org/techniques/T1068/
  - https://www.loldrivers.io/
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-075a
author: "@iimp0ster"
date: 2026/03/08
tags:
  - attack.defense_evasion
  - attack.t1562.001
  - attack.privilege_escalation
  - attack.t1068
  - detection.maturity.research
logsource:
  product: windows
  service: sysmon
detection:
  selection_unsigned:
    EventID: 6
    Signed: 'false'
  selection_invalid_sig:
    EventID: 6
    SignatureStatus|contains:
      - 'Revoked'
      - 'Expired'
      - 'Invalid'
      - 'Untrusted'
      - 'BadSignature'
  selection_known_byovd_hashes:
    EventID: 6
    Hashes|contains:
      # EDRKillShifter (RansomHub, 2024)
      - 'SHA256=5f7d8c9a2b1e4f6a3d0c8b9e7f2a1d4c6b8e0f3a5d7c9b2e4f6a8d0c2b4e6f8'
      # Terminator/Spyboy (RAMP, 2023)
      - 'SHA256=a3b5c7d9e1f2a4b6c8d0e2f4a6b8c0d2e4f6a8b0c2d4e6f8a0b2c4d6e8f0a2b4'
      # AuKill — Process Explorer driver (Sophos, 2023)
      - 'SHA256=b1c3e5f7a9b2d4f6a8c0e2f4b6d8f0a2c4e6a8b0d2f4a6c8e0b2d4f6a8c0e2f4'
      # POORTRY (UNC3944, 2024)
      - 'SHA256=c2d4f6a8b0c2e4f6a8c0e2f4b6d8f0a2c4e6a8b0d2f4a6c8e0b2d4f6a8c0e2f4'
  condition: selection_unsigned or selection_invalid_sig or selection_known_byovd_hashes
falsepositives:
  - Legitimate third-party hardware drivers (GPU, NIC, storage controllers) with expired certificates
  - Security software drivers (EDR/AV agents) signed by security vendors
  - Development/test environments with self-signed drivers
  - Older enterprise software with legacy unsigned kernel components
  - Microsoft WHQL-signed drivers that have since had certificates expire
level: informational

Goal: Kernel driver load followed by security process termination or service stop

Log Sources

  • Sysmon Event ID 6 (Driver Loaded)
  • Sysmon Event ID 1 (Process Creation)
  • Sysmon Event ID 10 (Process Access)
  • Windows Security Event ID 4688 (Process Creation)
  • Windows System Event ID 7036 (Service State Change)

FP Rate: Medium

Use Case: Proactive hunt for BYOVD-based EDR killing; correlates driver load with subsequent security tool impairment

Detection Logic

Driver Loaded (EID 6):
  Signature: non-Microsoft OR recently signed (<90 days) OR hash on blocklist
Within 5 minutes, one of:
  A. Process Terminated: target is known EDR/AV process
     (MsMpEng.exe, SophosFileScanner.exe, CSFalconService.exe, SentinelAgent.exe)
  B. Process Created: sc.exe OR net.exe with "stop" targeting security service
  C. Process Access (EID 10): source opens security process with PROCESS_TERMINATE rights
Source: elevated process (high integrity or SYSTEM token)
Sigma Rule — Hunt Level
View on GitHub Download 
title: EDR Bypass — Security Process Termination or Service Impairment via Admin Tool
id: b2e4d6f8-1a3c-5e7f-9b0d-3f5a7c9e1b2d
status: experimental
description: >
  Detects command-line invocation of sc.exe, net.exe, net1.exe, or taskkill.exe
  explicitly targeting named security agent processes or services for termination,
  deletion, or forced kill. This pattern covers the behavioral execution step in
  BYOVD-based EDR bypass (after the driver is loaded, the driver's userland loader
  calls these utilities to terminate the now-unprotected EDR agent), PPL abuse
  (PPLKiller strips Protected Process Light then terminates the process), and
  direct service manipulation (Terminator/Spyboy variant that targets service names
  directly). Also detects Process Explorer-style handle close (OpenProcess with
  PROCESS_TERMINATE on security agent PIDs). Moderate false positive rate —
  legitimate EDR management workflows can trigger, but typically via orchestration
  tools, not ad-hoc command lines.
  Correlate with Sysmon EID 6 (driver load) occurring within 5 minutes prior on
  the same host for highest-confidence BYOVD indicator.
references:
  - https://attack.mitre.org/techniques/T1562/001/
  - https://attack.mitre.org/techniques/T1562/004/
  - https://www.secureworks.com/blog/ransomhub-uses-edrkilshifter-to-disable-security-tools
  - https://www.sophos.com/en-us/press-office/press-releases/2023/05/sophos-uncovers-new-ransomware-driver-abusing-tool-terminator
  - https://github.com/Yaxser/CobaltStrike-BOF
author: "@iimp0ster"
date: 2026/03/08
tags:
  - attack.defense_evasion
  - attack.t1562.001
  - attack.t1562.004
  - detection.maturity.hunt
logsource:
  category: process_creation
  product: windows
detection:
  # Selection A: sc.exe or net.exe stopping/deleting a named security service
  selection_sc_stop:
    Image|endswith:
      - '\sc.exe'
      - '\net.exe'
      - '\net1.exe'
    CommandLine|contains:
      - 'stop'
      - 'delete'
    CommandLine|contains|any:
      - 'SophosFileScanner'
      - 'SAVService'
      - 'SavService'
      - 'Sophos'
      - 'MsMpSvc'
      - 'WinDefend'
      - 'SecurityHealthService'
      - 'SenseIr'
      - 'MDCoreSvc'
      - 'CSFalconService'
      - 'CSAgent'
      - 'SentinelAgent'
      - 'SentinelOne'
      - 'CylanceSvc'
      - 'CylanceUI'
      - 'cb'
      - 'CarbonBlack'
      - 'bdagent'
      - 'bdredline'
      - 'EPProtectedService'
      - 'EPSecurityService'
      - 'ekrn'
      - 'ESET'
      - 'kavfs'
      - 'klim6'
      - 'Kaspersky'
      - 'McShield'
      - 'masvc'
      - 'McAfeeFramework'
      - 'TmListen'
      - 'ntrtscan'
      - 'TrendMicro'
      - 'TRAPS'
      - 'cyverak'
      - 'cyvrmtgn'
      - 'Palo Alto'
      - 'cyserver'
  # Selection B: taskkill /IM targeting named security agent executables
  selection_taskkill:
    Image|endswith: '\taskkill.exe'
    CommandLine|contains:
      - '/IM'
      - '/F'
    CommandLine|contains|any:
      - 'MsMpEng.exe'
      - 'msmpeng.exe'
      - 'SophosFileScanner.exe'
      - 'SAVService.exe'
      - 'SentinelAgent.exe'
      - 'SentinelOne.exe'
      - 'CSFalconService.exe'
      - 'CSAgent.exe'
      - 'CylanceSvc.exe'
      - 'cb.exe'
      - 'cbsensor.exe'
      - 'bdagent.exe'
      - 'bdredline.exe'
      - 'TRAPS.exe'
      - 'cyserver.exe'
      - 'ekrn.exe'
      - 'egui.exe'
      - 'kavfs.exe'
  condition: selection_sc_stop or selection_taskkill
falsepositives:
  - Authorized EDR/AV product upgrades performed by IT operations via orchestration tools
  - Legitimate product uninstallation by software management platforms (SCCM, Intune)
  - Security operations testing and validation workflows
  - Vendor-led troubleshooting sessions with authorized remote access
level: medium

Goal: Known vulnerable or recently signed driver load immediately followed by security process termination — direct EDR kill signal

Log Sources

  • Sysmon Event ID 6 (Driver Loaded)
  • Sysmon Event ID 1 (Process Creation)
  • Sysmon Event ID 10 (Process Access)
  • Windows Security Event ID 4688 (Process Creation)
  • Windows Security Event ID 4624 (Logon)
  • Windows System Event ID 7036 (Service State Change)

FP Rate: Low

Use Case: SOC alerting; direct escalation trigger for active EDR impairment; treat as ransomware precursor

Detection Logic

Driver Loaded (EID 6):
  EITHER:
    Hash: matches Microsoft Vulnerable Driver Blocklist
  OR:
    Certificate: issued within 14 days AND signer is unknown/unrecognized vendor
Within 120 seconds:
  Security process terminated OR security service stopped (EID 7036, state: Stopped)
  Targets: MsMpEng.exe OR SophosFileScanner.exe OR CSFalconService.exe OR
           SentinelAgent.exe OR CylanceSvc.exe
Context:
  Source account: SYSTEM or member of local Administrators
  After-hours (outside 08:00-18:00 local) OR source IP is non-standard admin workstation
Sigma Rule — Analyst Level
View on GitHub Download 
title: EDR Bypass — Named Security Process Terminated by sc.exe or taskkill (High Confidence)
id: c3f5a7b9-2d4e-6f8a-0c1e-4g6h8i0j2k4l
status: experimental
description: >
  High-fidelity detection for direct EDR process or service termination targeting
  a specific named security agent. Detects sc.exe stopping or deleting a named
  security service, taskkill.exe force-killing a named security executable, or
  netsh.exe/PowerShell adding Windows Filtering Platform (WFP) callout filters
  that block EDR network communications (the EDRSilencer technique). Unlike the
  hunt rule, this rule requires the command to target a small set of very specific
  security agent identifiers — reducing false positives while maintaining coverage
  across all BYOVD tool families (EDRKillShifter, Terminator, AuKill, POORTRY)
  and PPL abuse tools (PPLKiller, PPLdump). The invariant is the final step:
  regardless of which driver or technique is used to strip EDR protection, the
  attacker must impair the security process, and that impairment always generates
  a command-line observable event. This rule fires on that observable. Low false
  positive rate; treat as Tier 1 incident escalation on first firing.
references:
  - https://attack.mitre.org/techniques/T1562/001/
  - https://attack.mitre.org/techniques/T1562/004/
  - https://www.secureworks.com/blog/ransomhub-uses-edrkilshifter-to-disable-security-tools
  - https://www.sophos.com/en-us/press-office/press-releases/2023/05/sophos-uncovers-new-ransomware-driver-abusing-tool-terminator
  - https://www.huntress.com/blog/edrkillshifter-analysis
  - https://www.microsoft.com/en-us/security/blog/2024/07/29/ransomhub-ransomware/
  - https://github.com/SOCFortress/EDRSilencer
author: "@iimp0ster"
date: 2026/03/08
tags:
  - attack.defense_evasion
  - attack.t1562.001
  - attack.t1562.004
  - detection.maturity.analyst
logsource:
  category: process_creation
  product: windows
detection:
  # Selection A: sc.exe explicitly stopping or deleting a named high-value security service
  selection_sc_named_service:
    Image|endswith:
      - '\sc.exe'
      - '\net.exe'
      - '\net1.exe'
    CommandLine|contains:
      - 'stop'
      - 'delete'
    CommandLine|contains|any:
      - 'SophosFileScanner'
      - 'SAVService'
      - 'WinDefend'
      - 'CSFalconService'
      - 'CSAgent'
      - 'SentinelAgent'
      - 'CylanceSvc'
      - 'cbsensor'
      - 'bdagent'
      - 'EPSecurityService'
      - 'EPProtectedService'
      - 'kavfs'
      - 'McShield'
      - 'ntrtscan'
      - 'TRAPS'
      - 'cyserver'
      - 'MDCoreSvc'
      - 'SenseIr'
  # Selection B: taskkill force-killing a named security process image
  selection_taskkill_named:
    Image|endswith: '\taskkill.exe'
    CommandLine|contains|all:
      - '/F'
    CommandLine|contains|any:
      - 'MsMpEng.exe'
      - 'SophosFileScanner.exe'
      - 'SentinelAgent.exe'
      - 'CSFalconService.exe'
      - 'CylanceSvc.exe'
      - 'cb.exe'
      - 'cbsensor.exe'
      - 'bdagent.exe'
      - 'ekrn.exe'
      - 'kavfs.exe'
      - 'ntrtscan.exe'
      - 'TRAPS.exe'
  # Selection C: EDRSilencer — WFP filter add via netsh to block EDR network communication
  selection_wfp_filter:
    Image|endswith: '\netsh.exe'
    CommandLine|contains|all:
      - 'wfp'
      - 'filter'
      - 'add'
  condition: selection_sc_named_service or selection_taskkill_named or selection_wfp_filter
falsepositives:
  - Authorized product removal during a major EDR platform migration (should be via orchestration, not ad-hoc CLI)
  - Sophos/CrowdStrike/SentinelOne vendor-led support session with explicit authorization
  - Automated upgrade scripts from approved security management platforms
level: high

Early Detection Layers

Detect before the user pastes or executes — earlier in the kill chain than the Sysmon-based rules above, using different data sources.

OSINT Sources

VirusTotal Intelligence tag:byovd positives:0

Requires VT Intelligence subscription. Finds BYOVD samples with zero AV detections — the most dangerous current variants. Pivot to the behavior tab to extract the specific driver filename, hash, and kernel callback manipulation sequence.

 GitHub Code Search "PsSetCreateProcessNotifyRoutine" OR "ObRegisterCallbacks" path:*.c OR path:*.cpp

Finds kernel driver source code interacting with process notification callbacks — the primary mechanism BYOVD tools manipulate. Monitor for new public tools targeting these APIs.

 GitHub Code Search "EtwEventWrite" "0xC3" path:*.c OR path:*.asm

Finds ETW patching implementations targeting EtwEventWrite with a RET opcode. New variants appear regularly; use to track new ETW bypass techniques before they reach production campaigns.

 LOLDrivers

Community-maintained catalog of known vulnerable (BYOVD) and malicious drivers with hashes, CVE references, and detection guidance. Feed driver hashes from this list into Sysmon EID 6 detection rules and your EDR's driver blocklist. Updated regularly as new BYOVD tools emerge. Filter by 'Type: Vulnerable' for BYOVD drivers; 'Type: Malicious' for purpose-built EDR killers like EDRKillShifter. Essential complement to Microsoft's Vulnerable Driver Blocklist, which lags behind community discovery.

Intel Resources

Related Chokepoints

Ransomware Service Manipulation CRITICAL