What Is an EDR Killer?
An EDR killer is a malicious tool designed to bypass or disable endpoint detection and response (EDR) solutions. It often leverages vulnerable or legitimately signed kernel drivers to unhook security protections, granting attackers low‑level control of the operating system.
Recent Real‑World Incident
Huntress researchers observed a ransomware‑related intrusion that deployed a custom EDR killer disguised as a firmware update utility. Key details include:
- Use of an old, signed kernel driver registered as a fake OEM hardware service, providing reboot‑resistant persistence.
- Aggressive internal reconnaissance: ICMP ping sweeps, NetBIOS name probes, SMB activity, and SYN flooding (>370 SYNs/sec).
- Attack stopped before the final ransomware payload could be delivered.
How to Detect EDR Killers
- Monitor for newly installed kernel drivers that claim to be OEM or hardware components.
- Alert on driver installation events that bypass standard signing checks or use legacy signatures.
- Track unusual network scanning patterns (ICMP, NetBIOS, SMB) originating from internal hosts.
- Leverage endpoint telemetry to spot sudden spikes in SYN packets or other flood‑type traffic.
Prevention Measures
- Deploy Windows Defender Application Control (WDAC) to enforce a whitelist of approved drivers.
- Enable Attack Surface Reduction (ASR) rules that block execution of unsigned or vulnerable drivers.
- Regularly audit driver catalogs and remove legacy or unnecessary OEM services.
- Apply strict least‑privilege policies for software installation and driver loading.
Recommended Response Workflow
Integrate the following steps into an automated playbook (e.g., using Tines or similar orchestration platforms) to reduce manual delays:
- Detect: Trigger on WDAC/ASR alerts or driver installation events.
- Contain: Isolate the affected endpoint and disable the suspicious driver service.
- Investigate: Pull forensic data with tools like EnCase to correlate driver artifacts with malicious activity.
- Remediate: Remove the driver, restore system integrity, and patch any exploited vulnerabilities.
- Report: Generate a detailed incident report for leadership and compliance.
Key Takeaways
Even with modern Windows defenses, attackers can still bypass EDR using signed kernel drivers masquerading as legitimate OEM services. Continuous monitoring, strict driver control policies, and automated response playbooks are essential to mitigate this threat.