DefenderKiller: Open-Source PoC Abuses Legacy Microsoft Driver (KSLDriver.sys) to Terminate Endpoint Security Processes

Key facts for DefenderKiller KSLDriver PoC

Detection coverage for DefenderKiller KSLDriver PoC

As of 2026-10-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4769 across Splunk SPL, Microsoft KQL and Sigma, covering 13 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: DefenderKiller KSLDriver.sys / KslD.sys Vulnerable Driver Load or Kernel Service Install — Exploitation (SPL)

Detects the BYOVD driver-load stage of DefenderKiller (TL-2026-4769): Sysmon EventCode 6 driver loads or System 7045 service installs that match the KSLDriver.sys SHA-256 (d5764d24...b0d645), the related KslD.sys MD5 (b316425d...c43, LOLDrivers PR 283), or a KSLDriver.sys / KslD.sys / DefenderKiller / KslD service name loaded from outside System32\drivers and Windows Defender directories. The legacy 2011-signed driver still loads on current Windows 11 and is the precursor to EDR/AV process termination.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1543.003, T1569.002, T1562.001, T1068, T1211, T1036.005
• Data sources: sysmon_driver_load_eid6, windows_system_7045, windows_security_4697, defender_for_endpoint_deviceevents
• Severity: high
• Confidence: high

Splunk SPL

(index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=6) OR (index=wineventlog sourcetype="WinEventLog:System" EventCode=7045) | eval drv_path=lower(coalesce(ImageLoaded, Service_File_Name, "")), svc=lower(coalesce(Service_Name, "")), hashes=lower(coalesce(Hashes, "")) | eval hash_hit=if(like(hashes, "%d5764d24e78914ab2a9db6b24e323342d0b37998f43add1a9e49b00992b0d645%") OR like(hashes, "%b316425d6f200244a25bd7b9998d9c43%"), 1, 0) | eval name_hit=if(match(drv_path, "(ksldriver|ksld)[.]sys") OR svc="defenderkiller" OR svc="ksld", 1, 0) | eval std_path=if(match(drv_path, "windows.system32.drivers.|windows defender."), 1, 0) | where hash_hit=1 OR (name_hit=1 AND std_path=0) | stats count min(_time) AS first_seen max(_time) AS last_seen values(EventCode) AS event_codes values(drv_path) AS driver_paths values(svc) AS services values(User) AS users BY host | convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

let ksl_sha256 = dynamic(["d5764d24e78914ab2a9db6b24e323342d0b37998f43add1a9e49b00992b0d645"]);
let ksl_md5 = dynamic(["b316425d6f200244a25bd7b9998d9c43"]);
let driver_loads = DeviceEvents
| where Timestamp > ago(24h)
| where ActionType == "DriverLoad"
| where SHA256 in~ (ksl_sha256) or MD5 in~ (ksl_md5) or (FileName in~ ("KSLDriver.sys", "KslD.sys") and not(FolderPath has_any (@"\System32\drivers\", @"\Windows Defender\")))
| project Timestamp, DeviceName, Source = "MDE-DriverLoad", Indicator = FileName, Detail = strcat(FolderPath, " sha256=", SHA256), Actor = InitiatingProcessFileName, ActorCmd = InitiatingProcessCommandLine, Account = InitiatingProcessAccountName;
let service_installs = SecurityEvent
| where TimeGenerated > ago(24h)
| where EventID == 4697
| where ServiceName =~ "DefenderKiller" or ServiceFileName has_any ("KSLDriver.sys", "KslD.sys")
| where not(ServiceFileName has_any (@"\System32\drivers\", @"\Windows Defender\"))
| project Timestamp = TimeGenerated, DeviceName = Computer, Source = "SecurityEvent-4697", Indicator = ServiceName, Detail = ServiceFileName, Actor = "", ActorCmd = "", Account = SubjectUserName;
union driver_loads, service_installs
| order by Timestamp desc

Sigma

title: DefenderKiller KSLDriver.sys / KslD.sys Vulnerable Driver Load
id: 3f6a1c52-8b7e-4d2a-9c41-5e0b7d1a2f94
status: experimental
description: Detects loading of the legacy Microsoft-signed KSLDriver.sys abused by DefenderKiller (SHA-256 d5764d24e78914ab2a9db6b24e323342d0b37998f43add1a9e49b00992b0d645) or the related KslD.sys (MD5 b316425d6f200244a25bd7b9998d9c43, LOLDrivers PR 283) from outside the standard driver directories. BYOVD step used to terminate EDR/AV processes or dump LSASS.
references:
  - https://flashpoint.io/blog/defenderkiller-how-vulnerable-drivers-are-being-abused-to-disable-endpoint-security/
  - https://github.com/magicsword-io/LOLDrivers/pull/283
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-10-29
tags:
  - attack.defense-evasion
  - attack.t1562.001
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1543.003
  - attack.t1068
  - attack.t1211
  - attack.t1036.005
logsource:
  category: driver_load
  product: windows
detection:
  selection_hash:
    Hashes|contains:
      - 'D5764D24E78914AB2A9DB6B24E323342D0B37998F43ADD1A9E49B00992B0D645'
      - 'B316425D6F200244A25BD7B9998D9C43'
  selection_name:
    ImageLoaded|endswith:
      - '\KSLDriver.sys'
      - '\KslD.sys'
  filter_legit_path:
    ImageLoaded|contains:
      - '\System32\drivers\'
      - '\Windows Defender\'
  condition: selection_hash or (selection_name and not filter_legit_path)
falsepositives:
  - Legitimate Microsoft Defender platform or Windows servicing updates that stage KslD.sys in a non-standard directory
  - Security researchers testing LOLDrivers samples
level: high
---
title: DefenderKiller Kernel Driver Service Installed
id: 7c0e9d14-2a65-4b8f-a3d7-61f4b2c85e03
status: experimental
description: Detects installation of a kernel-driver service named DefenderKiller, or a service whose image is KSLDriver.sys / KslD.sys outside the standard driver directories (System log event 7045). DefenderKiller creates this service and sets AllowedProcessName before starting the driver.
references:
  - https://flashpoint.io/blog/defenderkiller-how-vulnerable-drivers-are-being-abused-to-disable-endpoint-security/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-10-29
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1543.003
  - attack.execution
  - attack.t1569.002
  - attack.defense-evasion
  - attack.t1562.001
  - attack.t1068
logsource:
  product: windows
  service: system
detection:
  selection_evt:
    Provider_Name: 'Service Control Manager'
    EventID: 7045
  selection_svc:
    ServiceName: 'DefenderKiller'
  selection_img:
    ImagePath|endswith:
      - '\KSLDriver.sys'
      - '\KslD.sys'
  filter_legit_path:
    ImagePath|contains:
      - '\System32\drivers\'
      - '\Windows Defender\'
  condition: selection_evt and (selection_svc or (selection_img and not filter_legit_path))
falsepositives:
  - Legitimate Defender platform updates re-registering the KslD service
level: high

Known false positives:

• Microsoft Defender platform or servicing updates that stage KslD.sys outside System32\drivers
• Security researchers or red teams loading LOLDrivers samples in lab environments

Tuning notes: Add Defender platform staging directories observed in your estate to the std_path allow-list, and keep the hash matches unfiltered. Restrict to endpoints with Sysmon EventCode 6 enabled and ensure System 7045 is forwarded. Consider also alerting on any new kernel-type service created outside System32\drivers.

• 🔒 DefenderKiller [indicator] / [indicator] Vulnerable Driver Load or Kernel Service Install — Exploitation (KQL) · unlock with TL Creds
• 🔒 Driver Service Registry Tampering: [indicator] / SharedState / [indicator] (DefenderKiller, KslDump) — Post-Exploitation (KQL) · unlock with TL Creds
• 🔒 EDR/AV Process Termination Following Suspicious KSLDriver/KslD Driver Load — Defense Impairment (KQL) · unlock with TL Creds
• 🔒 DefenderKiller [indicator] / [indicator] Vulnerable Driver Load or Kernel Service Install — Exploitation (Sigma) · unlock with TL Creds
• 🔒 Driver Service Registry Tampering: [indicator] / SharedState / [indicator] (DefenderKiller, KslDump) — Post-Exploitation (Sigma) · unlock with TL Creds
• 🔒 EDR/AV Process Termination Following Suspicious KSLDriver/KslD Driver Load — Defense Impairment (Sigma) · unlock with TL Creds
• 🔒 Driver Service Registry Tampering: [indicator] / SharedState / [indicator] (DefenderKiller, KslDump) — Post-Exploitation (SPL) · unlock with TL Creds
• 🔒 EDR/AV Process Termination Following Suspicious KSLDriver/KslD Driver Load — Defense Impairment (SPL) · unlock with TL Creds

Indicators of compromise for DefenderKiller KSLDriver PoC

As of 2026-10-29, Threadlinqs Intelligence tracks 13 indicators of compromise for TL-2026-4769.

Sample indicators (2 of 13)

• File hash: d5764d24e78914ab2a9db6b24e323342d0b37998f43add1a9e49b00992b0d645
• File hash: b316425d6f200244a25bd7b9998d9c43

Defanged, TLP:CLEAR. Full set of 13 indicators: unlock with TL Creds.

How DefenderKiller KSLDriver PoC works

DefenderKiller is a Bring-Your-Own-Vulnerable-Driver (BYOVD) style EDR-killer proof of concept published on GitHub by researcher Jehad Abudagga (redteamfortress) on 2026-06-29 and analysed by the Flashpoint Intel Team on 2026-10-29. It abuses KSLDriver.sys version 1.1.0013.0 (SHA-256 d5764d24e78914ab2a9db6b24e323342d0b37998f43add1a9e49b00992b0d645), a legacy driver associated with Microsoft's malware protection infrastructure whose digital signature dates to 2011. Flashpoint states the driver is still accepted by Windows driver verification and can be loaded into the kernel on the latest version of Windows 11.

Mechanics: the driver reads an AllowedProcessName value from its service registry configuration and normally restricts access to SYSTEM and administrator accounts. DefenderKiller creates a service (named DefenderKiller, key HKLM\SYSTEM\CurrentControlSet\Services\DefenderKiller), sets the driver's ImagePath and an authorized process path (AllowedProcessName) BEFORE starting the driver, so the attacker's own process passes the driver's caller check. The driver accepts IOCTL requests from the authorized process and compares the caller's image path against the registry value. The authorized process can then call driver functionality that accepts a target process identifier (PID), obtains the corresponding kernel process object, and terminates it with ZwTerminateProcess(), which allows termination of protected endpoint security processes from user mode requests. Flashpoint summarises the flow in three stages: registry bypass, driver loading, process termination.

Privileges: exploitation generally requires administrative privileges to create the service needed to load the driver, although an attacker may obtain them through local privilege escalation. This makes DefenderKiller a post-compromise defense-impairment step typically run ahead of ransomware or hands-on-keyboard activity; however, the source does not tie it to any specific actor or campaign.

Spread: Flashpoint identified 13 publicly available samples incorporating the DefenderKiller technique, including obfuscated versions, indicating the original code is being modified and reused. Flashpoint assesses that advances in large language models may be contributing to growing interest in BYOVD research and EDR-killer development by lowering barriers to kernel-mode code development.

Related research (secondary sources, not part of the Flashpoint article): the same driver family (KslD.sys, Microsoft Malware Protection Kernel Support Driver) has been abused by KslDump/KslKatz/gokatz/kslkatz_bof/DefenderDump to read kernel/physical memory and dump LSASS under PPL via the same registry-edit trick (ImagePath pointing to an older 333 KB driver, AllowedProcessName/SharedState set to an attacker process, IOCTL 0x222044 exposing unrestricted physical and virtual memory reads, enabling KASLR bypass and token enumeration). LOLDrivers pull request #283 (submitted 2026-03-26, merged 2026-06-16) catalogues KslD.sys v4.18.26010.5 (MD5 b316425d6f200244a25bd7b9998d9c43) and references a Sigma rule. The source lists no CVE or CVSS score, no named targeted security products, and no network infrastructure; no BeaconBeagle lookup was applicable because there are no IP/domain IOCs. Severity is analyst-assigned (PoC only, no confirmed in-the-wild use).

MITRE ATT&CK techniques by tactic:

Credential Access

T1003.001 LSASS Memory

Execution

T1106 Native API; T1569.002 Service Execution

defense-impairment

T1112 Modify Registry

Persistence

T1543.003 Windows Service

Privilege Escalation

T1543.003 Windows Service

Defense Impairment

T1685 Disable or Modify Tools

Remediation for DefenderKiller KSLDriver PoC

Patches

• No vendor patch or CVE is stated in the source

Immediate actions

• Alert on creation of kernel-driver services whose ImagePath points outside %SystemRoot%\System32\drivers or Defender platform directories
• Hunt for service key HKLM\SYSTEM\CurrentControlSet\Services\DefenderKiller and driver file KSLDriver.sys / SHA-256 d5764d24e78914ab2a9db6b24e323342d0b37998f43add1a9e49b00992b0d645
• Alert on writes to AllowedProcessName and ImagePath values under driver service keys followed by a driver load
• Alert on unexpected termination of EDR/AV processes shortly after a driver load

Workarounds

• Block the known driver hash via WDAC / driver blocklist policy
• Audit and alert on kernel driver installation events (System log 7045, Sysmon Event ID 6)

Longer-term hardening

• Restrict local administrator rights to limit the ability to create and load driver services
• Enable the Microsoft vulnerable driver blocklist / HVCI / WDAC driver allow-listing where compatible
• Enable tamper protection and protected-process settings on endpoint security agents
• Monitor for new LOLDrivers-listed or legacy Microsoft-signed drivers loading on endpoints

Affected and fixed versions

• Microsoft — Windows 11 (loads KSLDriver.sys, Microsoft malware protection kernel driver)
  Vulnerable versions: KSLDriver.sys 1.1.0013.0 loads on latest Windows 11 per Flashpoint

Timeline of DefenderKiller KSLDriver PoC

• 2011-01-01 locked-ioc-6 v1.1.0013.0 digitally signed (source gives year 2011 only; date is year-precision placeholder)
• 2026-03-26 LOLDrivers pull request #283 submitted cataloguing the related locked-ioc-10 v4.18.26010.5, noting IOCTL 0x222044 memory-read primitives and locked-ioc-12/locked-ioc-11/locked-ioc-13/locked-ioc-8/locked-ioc-7 tooling
• 2026-06-16 LOLDrivers PR #283 merged, adding the locked-ioc-10 driver sample with structured YAML metadata and hash documentation
• 2026-06-29 Researcher Jehad Abudagga (redteamfortress) publishes locked-ioc-5 open-source PoC on GitHub and accompanying write-up
• 2026-10-29 Flashpoint recommends monitoring unexpected kernel driver installs, service config changes, security process terminations and locked-ioc-4/locked-ioc-9 changes
• 2026-10-29 Flashpoint reports 13 publicly available samples incorporating the locked-ioc-5 technique, including obfuscated versions
• 2026-10-29 Flashpoint Intel Team publishes analysis of locked-ioc-5 and BYOVD abuse of locked-ioc-6

Sources cited for DefenderKiller KSLDriver PoC

• Born to Defend, Weaponized to Kill: Weaponizing Microsoft's Own Driver to Kill EDRs (Jehad Abudagga) medium.com · Research · 2026-06-29
• How KslDump Uses a Microsoft Driver to Bypass PPL and Dump LSASS Credentials via Registry Edit besthub.dev · Research
• Reversing Windows Defender Vulnerable Driver: KslD.sys medium.com · Research
• LOLDrivers PR #283 - KslD.sys (Microsoft Malware Protection Kernel Support Driver) GitHub · Code repository · 2026-03-26
• KslKatz (S1lkys) - KslD.sys abuse tooling GitHub · Code repository
• KslDump (andreisss) - LSASS dumping via KslD.sys registry edit GitHub · Code repository
• DefenderKiller: How Vulnerable Drivers Are Being Abused to Disable Endpoint Security flashpoint.io · Blog · 2026-10-29

More in malware

• Corium: ClickFix Distribution and Campaign-Management Panel Advertised on Exploit.IN
• CastleLoader debuts in Red Canary top 10: paste-and-run delivery of NetSupport Manager, CastleRAT and .NET infostealer; KongTuke surge
• Recorteiro: Rust banking trojan with 'Recort' screen-hole overlay fraud distributed via fake EnergiaLusa electricity bills in Portugal
• SectopRAT delivered via GPULoader and VMLoader (GPU-based decryption, EtherHiding C2, FakeGuard AitM)
• NotC2: Proof-of-Concept Framework Abuses Amazon Bedrock, SQS, Lambda and SNS as Cloud Command-and-Control

Previous and next in malware

• Clipbanker malware AnimateClipper (ZigClipper) and Efimer redirect crypto payments by swapping clipboard wallet addresses Previous report
• Amadey MaaS Backend Breached by Australian Signals Directorate; 180,000 Infected Computers Cut Off from Operator C2 Next report