GoKawiilPart 2 in a series on BYOVD threats. You can read Part 1 here.
EDR killers, once a rarity in the threat landscape, are now linchpins of perplexing ransomware attacks, leaving enterprise security teams scrambling for answers.
Over the past year, security researchers have observed an expansion of the ecosystem around these tools, which can disable endpoint detection and response (EDR) platforms and other threat detection products in a targeted environment. EDR killers typically accomplish this through a technique known as bring-your-own-vulnerable-driver (BYOVD), which abuses legitimate software drivers with Windows kernel access to terminate security processes.
The growth of BYOVD and the commercialization of EDR killers, which have become a favorite among ransomware groups, has alarmed vendors and researchers and put Microsoft between a rock and a hard place. While only a small number of vulnerable drivers are actually abused by these EDR killers, blocking them can cause applications and Windows systems to crash.
Related:'BlueHammer' Windows Zero-Day Exploit Signals Microsoft Bug Disclosure Issues
Security teams face a precarious situation: ransomware actors can defeat core components of their defenses without warning and shut down their networks, but preemptively blocking these vulnerable drivers could also cause significant disruptions.
Peter Morgan, vice president of research at Halcyon, tells Dark Reading that vulnerable drivers have created yet another lopsided arms race for cybersecurity. Instead of investing time and money into finding vulnerabilities in EDR platforms to hack them directly, threat actors can easily acquire one of many EDR killers.
"For the immediate future, I think the kernel driver space is going to be the sweet spot for them," Morgan says.
Few Vulnerable Drivers, Many EDR Killers
In a recent report, ESET researchers documented nearly 90 unique EDR killers, most of which use the BYOVD technique (some newer, alternative EDR killers use scripts or anti-rootkit technology instead). The tools are readily available from underground marketplaces and public proof-of-concept (PoC) exploits, and have become "plug-and-play" components.
... continue reading