BYOVD EDR Killer Tooling — Ransomware Groups Weaponizing Signed Kernel Drivers to Blind Endpoint Detection
BYOVD EDR Killer Tooling (TL-2026-0091) is a high-severity malware campaign, first published 2026-02-04. It is attributed to Scattered Spider with high confidence, references 1 CVE (CVE-2015-2291), maps to 21 MITRE ATT&CK techniques (T1003.001, T1014, T1021.002), and is covered by 9 detection rules and 43 indicators of compromise.
Key facts for TL-2026-0091
- Threat ID
- TL-2026-0091
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-02-04
- Last reviewed
- 2026-02-04
- Attribution
- Scattered Spider
- Attribution confidence
- HIGH
- Motivation
- FINANCIAL
- Target sectors
- All sectors — technique is sector-agnostic, Healthcare, Financial, Manufacturing, Government, Technology, Telecom, BPO
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 43
BYOVD (Bring Your Own Vulnerable Driver) EDR Killer is a rapidly proliferating defense evasion technique where threat actors load legitimately signed but vulnerable kernel drivers to terminate endpoint detection and response (EDR) and antivirus processes from kernel mode. Multiple documented toolkits exploit this technique: AuKill abuses Sysinternals Process Explorer driver (PROCEXP152.sys), Poortry/Stonestop use Microsoft-signed malicious drivers, EDRKillShifter (RansomHub) dynamically selects from multiple vulnerable drivers, Terminator (Spyboy) uses Zemana Anti-Malware driver (zam64.sys), and SCATTERED SPIDER exploits the Intel Ethernet diagnostics driver (iqvw64.sys/CVE-2015-2291). These tools are deployed as pre-ransomware defense evasion, blinding security products before encryption. The LOLDrivers.io project catalogs 700+ vulnerable/malicious kernel drivers. Microsoft's Vulnerable Driver Blocklist is the primary defense but remains incomplete and not universally enforced.
How BYOVD EDR Killer Tooling works
Bring Your Own Vulnerable Driver (BYOVD) is a kernel-level defense evasion technique that exploits a fundamental architectural weakness in Windows security. Since 64-bit Windows Vista, unsigned kernel-mode drivers cannot run by default. BYOVD circumvents this by loading legitimately signed vulnerable drivers that contain exploitable IOCTL handlers, memory read/write primitives, or process termination capabilities. Once loaded with administrative privileges, these drivers operate at Ring 0 (kernel mode), granting attackers the ability to terminate any userspace process — including EDR agents, antivirus services, and security monitoring tools — from a privilege level those tools cannot defend against.
The technique has become the dominant pre-ransomware defense evasion method, with multiple documented toolkits:
**AuKill (Sophos, April 2023):** Abuses the Sysinternals Process Explorer driver (PROCEXP152.sys) to kill security processes. The legitimate Process Explorer driver is signed by Microsoft and provides kernel-level process management. AuKill drops the driver, loads it as a service, then uses its IOCTL interface to terminate a target list of 50+ EDR/AV processes. Observed in Medusa Locker and LockBit ransomware deployments.
**Poortry/Stonestop (Microsoft/Mandiant, 2022-2023):** A malicious kernel driver (Poortry) paired with a userspace loader (Stonestop). The most notable variant used drivers signed with legitimate Microsoft Windows Hardware Compatibility Program (WHCP) certificates — meaning the malicious driver was actually signed by Microsoft's own infrastructure. This represented a catastrophic failure of the code-signing trust model. Used by UNC3944/SCATTERED SPIDER and CUBA ransomware affiliates.
**EDRKillShifter (Sophos, August 2024):** Associated with RansomHub affiliates. A loader-based architecture that dynamically selects from multiple vulnerable drivers based on the target environment. The tool is designed for modularity — the attacker specifies which driver to abuse, making signature-based detection harder. Includes anti-analysis features and supports multiple exploitation paths.
**Terminator (Spyboy, 2023):** Sold on cybercrime forums as a commercial EDR-killing service. Abuses the Zemana Anti-Malware driver (zam64.sys/zamguard64.sys) to terminate security processes. Advertised as capable of killing 23+ EDR/AV products. The driver is legitimately signed by Zemana and provides kernel-level file/process operations.
**SCATTERED SPIDER / BYOVD Campaign (CrowdStrike, January 2023):** SCATTERED SPIDER (Roasted 0ktapus/UNC3944) deployed malicious kernel drivers through CVE-2015-2291, a vulnerability in the Intel Ethernet diagnostics driver (iqvw64.sys). The malicious driver specifically targeted CrowdStrike Falcon's kernel component (csagent.sys), scanning for hard-coded byte patterns and patching routines with trampoline code. Drivers were signed with stolen NVIDIA and Global Software LLC certificates. The malicious driver used XOR decryption (key: i % 56 + 49) to reveal its target process list.
The fundamental problem is architectural: Windows allows any driver with a valid (or once-valid) signature to load into the kernel, where it can manipulate any process, memory region, or security control. Microsoft's Vulnerable Driver Blocklist (enabled by default since Windows 11 2022 update) blocks known-bad drivers but is incomplete, updated infrequently (1-2 times per year via major Windows releases), and does not cover newly discovered vulnerable drivers. The LOLDrivers.io project catalogs 700+ vulnerable and malicious drivers with hashes, providing the community's most comprehensive driver blocklist.
MITRE ATT&CK techniques used in TL-2026-0091
credential-access
defense-evasion
T1014 Rootkit; T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1070.004 File Deletion
lateral-movement
T1021.002 SMB/Windows Admin Shares
discovery
T1057 Process Discovery; T1518.001 Security Software Discovery
execution
T1059.001 PowerShell; T1059.003 Windows Command Shell; T1569.002 Service Execution
privilege-escalation
T1068 Exploitation for Privilege Escalation
impact
T1486 Data Encrypted for Impact; T1489 Service Stop
persistence
T1543.003 Windows Service; T1547.006 Kernel Modules and Extensions
defense-impairment
T1553.002 Code Signing; T1685 Disable or Modify Tools; T1686 Disable or Modify System Firewall; T1688 Safe Mode Boot
resource-development
Remediation for BYOVD EDR Killer Tooling
Patches
- CVE-2015-2291 — Intel iqvw64.sys patched (but old versions widely available for BYOVD)
- Microsoft Vulnerable Driver Blocklist — updated periodically via Windows Update
- LOLDrivers.io community blocklist — continuously updated
Immediate actions
- Enable Microsoft Vulnerable Driver Blocklist on all Windows endpoints (Settings > Privacy & Security > Windows Security > Device Security > Core Isolation)
- Deploy the latest WDAC/App Control blocklist from Microsoft — the OS-shipped version lags behind
- Enable HVCI (Hypervisor-Protected Code Integrity) to enforce driver signing at hypervisor level
- Enable ASR rule 'Block abuse of exploited vulnerable signed drivers' in Microsoft Defender
- Monitor for kernel driver load events (Sysmon EventCode 6) from unexpected paths
- Block known BYOVD drivers by hash at endpoint: iqvw64.sys, PROCEXP152.sys (when dropped outside Sysinternals), zam64.sys
Workarounds
- Restrict local admin privileges — BYOVD requires admin to load drivers
- Deploy application control (WDAC/AppLocker) to prevent unauthorized driver installation
- Monitor for driver loading from TEMP, Downloads, or other non-standard paths
Longer-term hardening
- Deploy LOLDrivers.io blocklist as supplementary WDAC policy — covers 700+ drivers not in Microsoft's default list
- Implement driver allowlisting: only permit known-good kernel drivers to load
- Enable Windows Defender Credential Guard and Secure Boot to limit kernel attack surface
- Deploy EDR solutions with kernel-level self-protection (e.g., Protected Process Light / PPL)
- Monitor for sc.exe creating new kernel services or loading drivers outside standard paths
- Audit code-signing certificates — revoked certificates should not be trusted for driver loading
- Implement ELAM (Early Launch Anti-Malware) drivers that load before third-party drivers
CVEs associated with BYOVD EDR Killer Tooling
Weaknesses (CWE) in BYOVD EDR Killer Tooling
CWE-269
Timeline of BYOVD EDR Killer Tooling
- CVE-2015-2291 disclosed: Intel Ethernet diagnostics driver (iqvw64.sys) allows privilege escalation. Later becomes one of the most abused BYOVD drivers. Source: NVD
- Microsoft launches Vulnerable and Malicious Driver Reporting Center, acknowledging adversaries increasingly leverage legitimate signed drivers. Source: Microsoft Security Blog
- Trend Micro discovers ransomware actor abusing Genshin Impact anti-cheat driver (mhyprot2.sys) for kernel-level AV termination via IOCTL 0x81034000. First documented gaming anti-cheat driver abuse in BYOVD. Source: Trend Micro
- Mandiant/Microsoft discover Poortry/Stonestop: malicious kernel driver signed with legitimate Microsoft WHCP certificates. Used by UNC3944/SCATTERED SPIDER and CUBA ransomware. Catastrophic failure of code-signing trust model.
- Windows 11 2022 update enables Vulnerable Driver Blocklist by default for all devices. However, the blocklist is incomplete and updated only 1-2 times per year. Source: Microsoft
- CrowdStrike publishes analysis of SCATTERED SPIDER using CVE-2015-2291 (iqvw64.sys) to deploy malicious kernel driver targeting csagent.sys. Driver signed with stolen NVIDIA and Global Software LLC certificates. Source: CrowdStrike
- Sophos discovers AuKill: EDR-killer tool abusing Sysinternals Process Explorer driver (PROCEXP152.sys) to terminate 50+ security processes. Deployed with Medusa Locker and LockBit ransomware. Source: Sophos
- Spyboy advertises 'Terminator' EDR killer on cybercrime forums. Abuses Zemana Anti-Malware driver (zam64.sys) to terminate 23+ EDR/AV products. Sold as commercial service.
- LOLDrivers.io project launches, cataloging 700+ vulnerable and malicious kernel drivers with hashes, detection rules, and MITRE mappings. Becomes the community standard for driver blocklisting. Source: https://www.loldrivers.io/
- Sophos discovers EDRKillShifter: modular EDR-killer used by RansomHub affiliates. Dynamically selects vulnerable drivers based on target environment. Includes anti-analysis features. Source: Sophos
- Microsoft updates recommended driver block rules documentation. Blocklist expanded but still acknowledged as incomplete — holds back some blocks to avoid breaking functionality. Source: Microsoft Learn
- Picus Security publishes comprehensive BYOVD explainer covering attack chain, mhyprot2.sys case study, HVCI defense guidance, and Sysmon Event ID 6 detection configurations. Source: Picus Security
- As of 2026-05-29, BYOVD EDR-killer tooling is still active and escalating: ESET (Mar 2026) tracks 54 BYOVD killers abusing 35 signed drivers, and Huntress + Reynolds ransomware incidents (Feb 2026) show live pre-encryption use. CVE-2015-2291 remains in CISA KEV; no takedown or successor exists, so status stays ACTIVE.
Sources cited for BYOVD EDR Killer Tooling
- CrowdStrike: SCATTERED SPIDER BYOVD Attack on Falcon Sensor
- Microsoft: Recommended Driver Block Rules
- LOLDrivers.io — Living Off The Land Drivers
- MITRE ATT&CK — T1562.001: Impair Defenses: Disable or Modify Tools
- Sophos: AuKill Abuses Process Explorer Driver
- Sophos: EDRKillShifter — RansomHub EDR Killer
- NVD — CVE-2015-2291: Intel Ethernet Diagnostics Driver
- Microsoft: Improve Kernel Security with Vulnerable Driver Reporting Center
- OpenText EnCase Forensic — Legitimate Forensic Software
- MITRE ATT&CK — T1068: Exploitation for Privilege Escalation
- What Are Bring Your Own Vulnerable Driver (BYOVD) Attacks?
Threats related to BYOVD EDR Killer Tooling
Detection coverage for TL-2026-0091
As of 2026-02-04, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0091 across Splunk SPL, Microsoft KQL and Sigma, covering 43 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.