# BYOVD EDR Killer Tooling — Ransomware Groups Weaponizing Signed Kernel Drivers to Blind Endpoint Detection

> BYOVD (Bring Your Own Vulnerable Driver) EDR Killer is a rapidly proliferating defense evasion technique where threat actors load legitimately signed but vulnerable kernel drivers to terminate endpoint detection and response (EDR) and antivirus processes from kernel mode. Multiple documented toolkits exploit this technique: AuKill abuses Sysinternals Process Explorer driver (PROCEXP152.sys), Poortry/Stonestop use Microsoft-signed malicious drivers, EDRKillShifter (RansomHub) dynamically selects from multiple vulnerable drivers, Terminator (Spyboy) uses Zemana Anti-Malware driver (zam64.sys), and SCATTERED SPIDER exploits the Intel Ethernet diagnostics driver (iqvw64.sys/CVE-2015-2291). These tools are deployed as pre-ransomware defense evasion, blinding security products before encryption. The LOLDrivers.io project catalogs 700+ vulnerable/malicious kernel drivers. Microsoft's Vulnerable Driver Blocklist is the primary defense but remains incomplete and not universally enforced.

- **Published:** 2026-02-04T16:10:00Z
- **Last reviewed:** 2026-10-21T17:33:57.775Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0091
- **ID:** TL-2026-0091
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Scattered Spider
- **Detections:** 9 · **IOCs:** 59 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2015-2291, CVE-2018-19320

## Description

Bring Your Own Vulnerable Driver (BYOVD) is a kernel-level defense evasion technique that exploits a fundamental architectural weakness in Windows security. Since 64-bit Windows Vista, unsigned kernel-mode drivers cannot run by default. BYOVD circumvents this by loading legitimately signed vulnerable drivers that contain exploitable IOCTL handlers, memory read/write primitives, or process termination capabilities. Once loaded with administrative privileges, these drivers operate at Ring 0 (kernel mode), granting attackers the ability to terminate any userspace process — including EDR agents, antivirus services, and security monitoring tools — from a privilege level those tools cannot defend against.

The technique has become the dominant pre-ransomware defense evasion method, with multiple documented toolkits:

**AuKill (Sophos, April 2023):** Abuses the Sysinternals Process Explorer driver (PROCEXP152.sys) to kill security processes. The legitimate Process Explorer driver is signed by Microsoft and provides kernel-level process management. AuKill drops the driver, loads it as a service, then uses its IOCTL interface to terminate a target list of 50+ EDR/AV processes. Observed in Medusa Locker and LockBit ransomware deployments.

**Poortry/Stonestop (Microsoft/Mandiant, 2022-2023):** A malicious kernel driver (Poortry) paired with a userspace loader (Stonestop). The most notable variant used drivers signed with legitimate Microsoft Windows Hardware Compatibility Program (WHCP) certificates — meaning the malicious driver was actually signed by Microsoft's own infrastructure. This represented a catastrophic failure of the code-signing trust model. Used by UNC3944/SCATTERED SPIDER and CUBA ransomware affiliates.

**EDRKillShifter (Sophos, August 2024):** Associated with RansomHub affiliates. A loader-based architecture that dynamically selects from multiple vulnerable drivers based on the target environment. The tool is designed for modularity — the attacker specifies which driver to abuse, making signature-based detection harder. Includes anti-analysis features and supports multiple exploitation paths.

**Terminator (Spyboy, 2023):** Sold on cybercrime forums as a commercial EDR-killing service. Abuses the Zemana Anti-Malware driver (zam64.sys/zamguard64.sys) to terminate security processes. Advertised as capable of killing 23+ EDR/AV products. The driver is legitimately signed by Zemana and provides kernel-level file/process operations.

**SCATTERED SPIDER / BYOVD Campaign (CrowdStrike, January 2023):** SCATTERED SPIDER (Roasted 0ktapus/UNC3944) deployed malicious kernel drivers through CVE-2015-2291, a vulnerability in the Intel Ethernet diagnostics driver (iqvw64.sys). The malicious driver specifically targeted CrowdStrike Falcon's kernel component (csagent.sys), scanning for hard-coded byte patterns and patching routines with trampoline code. Drivers were signed with stolen NVIDIA and Global Software LLC certificates. The malicious driver used XOR decryption (key: i % 56 + 49) to reveal its target process list.

The fundamental problem is architectural: Windows allows any driver with a valid (or once-valid) signature to load into the kernel, where it can manipulate any process, memory region, or security control. Microsoft's Vulnerable Driver Blocklist (enabled by default since Windows 11 2022 update) blocks known-bad drivers but is incomplete, updated infrequently (1-2 times per year via major Windows releases), and does not cover newly discovered vulnerable drivers. The LOLDrivers.io project catalogs 700+ vulnerable and malicious drivers with hashes, providing the community's most comprehensive driver blocklist.

## MITRE ATT&CK

- T1685 Disable or Modify Tools
- T1068 Exploitation for Privilege Escalation
- T1543.003 Windows Service
- T1569.002 Service Execution
- T1553.002 Code Signing
- T1014 Rootkit
- T1057 Process Discovery
- T1518.001 Security Software Discovery
- T1027 Obfuscated Files or Information
- T1059.003 Windows Command Shell
- T1036.005 Match Legitimate Resource Name or Location
- T1588.002 Tool
- T1489 Service Stop
- T1070.004 File Deletion
- T1547.006 Kernel Modules and Extensions
- T1021.002 SMB/Windows Admin Shares
- T1486 Data Encrypted for Impact
- T1686 Disable or Modify System Firewall
- T1003.001 LSASS Memory
- T1059.001 PowerShell
- T1688 Safe Mode Boot
- T1106 Native API
- T1574.002 DLL Side-Loading
- T1140 Deobfuscate/Decode Files or Information
- T1078 Valid Accounts
- T1133 External Remote Services
- T1572 Protocol Tunneling
- T1090 Proxy

## Sources

- [CrowdStrike: SCATTERED SPIDER BYOVD Attack on Falcon Sensor](https://www.crowdstrike.com/en-us/blog/scattered-spider-attempts-to-avoid-detection-with-bring-your-own-vulnerable-driver-tactic/)
- [Microsoft: Recommended Driver Block Rules](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/microsoft-recommended-driver-block-rules)
- [LOLDrivers.io — Living Off The Land Drivers](https://www.loldrivers.io/)
- [MITRE ATT&CK — T1562.001: Impair Defenses: Disable or Modify Tools](https://attack.mitre.org/techniques/T1562/001/)
- [Sophos: AuKill Abuses Process Explorer Driver](https://news.sophos.com/en-us/2023/04/19/aukill-edrkiller-malware-abuses-process-explorer-driver/)
- [Sophos: EDRKillShifter — RansomHub EDR Killer](https://news.sophos.com/en-us/2024/08/14/edr-kill-shifter/)
- [NVD — CVE-2015-2291: Intel Ethernet Diagnostics Driver](https://nvd.nist.gov/vuln/detail/CVE-2015-2291)
- [Microsoft: Improve Kernel Security with Vulnerable Driver Reporting Center](https://www.microsoft.com/en-us/security/blog/2021/12/08/improve-kernel-security-with-the-new-microsoft-vulnerable-and-malicious-driver-reporting-center/)
- [OpenText EnCase Forensic — Legitimate Forensic Software](https://www.opentext.com/products/encase-forensic)
- [MITRE ATT&CK — T1068: Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068/)
- [What Are Bring Your Own Vulnerable Driver (BYOVD) Attacks?](https://www.picussecurity.com/resource/blog/what-are-bring-your-own-vulnerable-driver-byovd-attacks)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0091