# DefenderKiller: Open-Source PoC Abuses Legacy Microsoft Driver (KSLDriver.sys) to Terminate Endpoint Security Processes

> DefenderKiller is an open-source proof of concept that loads the legacy, 2011-signed Microsoft-associated driver KSLDriver.sys (v1.1.0013.0) on Windows 11 and, by pre-setting registry values the driver trusts, terminates arbitrary processes such as EDR/AV agents. Flashpoint reports no threat-actor attribution or confirmed in-the-wild exploitation, but identified 13 public samples incorporating the technique, including obfuscated variants.

- **Published:** 2026-10-29T20:40:59Z
- **Last reviewed:** 2026-10-29T20:40:59Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4769
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-4769.png
- **ID:** TL-2026-4769
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 13 (2 shown free below)

## Description

DefenderKiller is a Bring-Your-Own-Vulnerable-Driver (BYOVD) style EDR-killer proof of concept published on GitHub by researcher Jehad Abudagga (redteamfortress) on 2026-06-29 and analysed by the Flashpoint Intel Team on 2026-10-29. It abuses KSLDriver.sys version 1.1.0013.0 (SHA-256 d5764d24e78914ab2a9db6b24e323342d0b37998f43add1a9e49b00992b0d645), a legacy driver associated with Microsoft's malware protection infrastructure whose digital signature dates to 2011. Flashpoint states the driver is still accepted by Windows driver verification and can be loaded into the kernel on the latest version of Windows 11.

Mechanics: the driver reads an AllowedProcessName value from its service registry configuration and normally restricts access to SYSTEM and administrator accounts. DefenderKiller creates a service (named DefenderKiller, key HKLM\SYSTEM\CurrentControlSet\Services\DefenderKiller), sets the driver's ImagePath and an authorized process path (AllowedProcessName) BEFORE starting the driver, so the attacker's own process passes the driver's caller check. The driver accepts IOCTL requests from the authorized process and compares the caller's image path against the registry value. The authorized process can then call driver functionality that accepts a target process identifier (PID), obtains the corresponding kernel process object, and terminates it with ZwTerminateProcess(), which allows termination of protected endpoint security processes from user mode requests. Flashpoint summarises the flow in three stages: registry bypass, driver loading, process termination.

Privileges: exploitation generally requires administrative privileges to create the service needed to load the driver, although an attacker may obtain them through local privilege escalation. This makes DefenderKiller a post-compromise defense-impairment step typically run ahead of ransomware or hands-on-keyboard activity; however, the source does not tie it to any specific actor or campaign.

Spread: Flashpoint identified 13 publicly available samples incorporating the DefenderKiller technique, including obfuscated versions, indicating the original code is being modified and reused. Flashpoint assesses that advances in large language models may be contributing to growing interest in BYOVD research and EDR-killer development by lowering barriers to kernel-mode code development.

Related research (secondary sources, not part of the Flashpoint article): the same driver family (KslD.sys, Microsoft Malware Protection Kernel Support Driver) has been abused by KslDump/KslKatz/gokatz/kslkatz_bof/DefenderDump to read kernel/physical memory and dump LSASS under PPL via the same registry-edit trick (ImagePath pointing to an older 333 KB driver, AllowedProcessName/SharedState set to an attacker process, IOCTL 0x222044 exposing unrestricted physical and virtual memory reads, enabling KASLR bypass and token enumeration). LOLDrivers pull request #283 (submitted 2026-03-26, merged 2026-06-16) catalogues KslD.sys v4.18.26010.5 (MD5 b316425d6f200244a25bd7b9998d9c43) and references a Sigma rule. The source lists no CVE or CVSS score, no named targeted security products, and no network infrastructure; no BeaconBeagle lookup was applicable because there are no IP/domain IOCs. Severity is analyst-assigned (PoC only, no confirmed in-the-wild use).

## MITRE ATT&CK

- T1685 Disable or Modify Tools
- T1543.003 Windows Service
- T1543.003 Windows Service
- T1112 Modify Registry
- T1569.002 Service Execution
- T1106 Native API
- T1003.001 LSASS Memory

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**DefenderKiller KSLDriver.sys / KslD.sys Vulnerable Driver Load or Kernel Service Install — Exploitation (SPL)** (`TL-2026-4769-SPL-001`)

Detects the BYOVD driver-load stage of DefenderKiller (TL-2026-4769): Sysmon EventCode 6 driver loads or System 7045 service installs that match the KSLDriver.sys SHA-256 (d5764d24...b0d645), the related KslD.sys MD5 (b316425d...c43, LOLDrivers PR 283), or a KSLDriver.sys / KslD.sys / DefenderKiller / KslD service name loaded from outside System32\drivers and Windows Defender directories. The legacy 2011-signed driver still loads on current Windows 11 and is the precursor to EDR/AV process termination.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1543.003, T1569.002, T1562.001, T1068, T1211, T1036.005
- **Data sources:** sysmon_driver_load_eid6, windows_system_7045, windows_security_4697, defender_for_endpoint_deviceevents
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
(index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=6) OR (index=wineventlog sourcetype="WinEventLog:System" EventCode=7045) | eval drv_path=lower(coalesce(ImageLoaded, Service_File_Name, "")), svc=lower(coalesce(Service_Name, "")), hashes=lower(coalesce(Hashes, "")) | eval hash_hit=if(like(hashes, "%d5764d24e78914ab2a9db6b24e323342d0b37998f43add1a9e49b00992b0d645%") OR like(hashes, "%b316425d6f200244a25bd7b9998d9c43%"), 1, 0) | eval name_hit=if(match(drv_path, "(ksldriver|ksld)[.]sys") OR svc="defenderkiller" OR svc="ksld", 1, 0) | eval std_path=if(match(drv_path, "windows.system32.drivers.|windows defender."), 1, 0) | where hash_hit=1 OR (name_hit=1 AND std_path=0) | stats count min(_time) AS first_seen max(_time) AS last_seen values(EventCode) AS event_codes values(drv_path) AS driver_paths values(svc) AS services values(User) AS users BY host | convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
let ksl_sha256 = dynamic(["d5764d24e78914ab2a9db6b24e323342d0b37998f43add1a9e49b00992b0d645"]);
let ksl_md5 = dynamic(["b316425d6f200244a25bd7b9998d9c43"]);
let driver_loads = DeviceEvents
| where Timestamp > ago(24h)
| where ActionType == "DriverLoad"
| where SHA256 in~ (ksl_sha256) or MD5 in~ (ksl_md5) or (FileName in~ ("KSLDriver.sys", "KslD.sys") and not(FolderPath has_any (@"\System32\drivers\", @"\Windows Defender\")))
| project Timestamp, DeviceName, Source = "MDE-DriverLoad", Indicator = FileName, Detail = strcat(FolderPath, " sha256=", SHA256), Actor = InitiatingProcessFileName, ActorCmd = InitiatingProcessCommandLine, Account = InitiatingProcessAccountName;
let service_installs = SecurityEvent
| where TimeGenerated > ago(24h)
| where EventID == 4697
| where ServiceName =~ "DefenderKiller" or ServiceFileName has_any ("KSLDriver.sys", "KslD.sys")
| where not(ServiceFileName has_any (@"\System32\drivers\", @"\Windows Defender\"))
| project Timestamp = TimeGenerated, DeviceName = Computer, Source = "SecurityEvent-4697", Indicator = ServiceName, Detail = ServiceFileName, Actor = "", ActorCmd = "", Account = SubjectUserName;
union driver_loads, service_installs
| order by Timestamp desc
```

### Sigma

```yaml
title: DefenderKiller KSLDriver.sys / KslD.sys Vulnerable Driver Load
id: 3f6a1c52-8b7e-4d2a-9c41-5e0b7d1a2f94
status: experimental
description: Detects loading of the legacy Microsoft-signed KSLDriver.sys abused by DefenderKiller (SHA-256 d5764d24e78914ab2a9db6b24e323342d0b37998f43add1a9e49b00992b0d645) or the related KslD.sys (MD5 b316425d6f200244a25bd7b9998d9c43, LOLDrivers PR 283) from outside the standard driver directories. BYOVD step used to terminate EDR/AV processes or dump LSASS.
references:
  - https://flashpoint.io/blog/defenderkiller-how-vulnerable-drivers-are-being-abused-to-disable-endpoint-security/
  - https://github.com/magicsword-io/LOLDrivers/pull/283
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-10-29
tags:
  - attack.defense-evasion
  - attack.t1562.001
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1543.003
  - attack.t1068
  - attack.t1211
  - attack.t1036.005
logsource:
  category: driver_load
  product: windows
detection:
  selection_hash:
    Hashes|contains:
      - 'D5764D24E78914AB2A9DB6B24E323342D0B37998F43ADD1A9E49B00992B0D645'
      - 'B316425D6F200244A25BD7B9998D9C43'
  selection_name:
    ImageLoaded|endswith:
      - '\KSLDriver.sys'
      - '\KslD.sys'
  filter_legit_path:
    ImageLoaded|contains:
      - '\System32\drivers\'
      - '\Windows Defender\'
  condition: selection_hash or (selection_name and not filter_legit_path)
falsepositives:
  - Legitimate Microsoft Defender platform or Windows servicing updates that stage KslD.sys in a non-standard directory
  - Security researchers testing LOLDrivers samples
level: high
---
title: DefenderKiller Kernel Driver Service Installed
id: 7c0e9d14-2a65-4b8f-a3d7-61f4b2c85e03
status: experimental
description: Detects installation of a kernel-driver service named DefenderKiller, or a service whose image is KSLDriver.sys / KslD.sys outside the standard driver directories (System log event 7045). DefenderKiller creates this service and sets AllowedProcessName before starting the driver.
references:
  - https://flashpoint.io/blog/defenderkiller-how-vulnerable-drivers-are-being-abused-to-disable-endpoint-security/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-10-29
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1543.003
  - attack.execution
  - attack.t1569.002
  - attack.defense-evasion
  - attack.t1562.001
  - attack.t1068
logsource:
  product: windows
  service: system
detection:
  selection_evt:
    Provider_Name: 'Service Control Manager'
    EventID: 7045
  selection_svc:
    ServiceName: 'DefenderKiller'
  selection_img:
    ImagePath|endswith:
      - '\KSLDriver.sys'
      - '\KslD.sys'
  filter_legit_path:
    ImagePath|contains:
      - '\System32\drivers\'
      - '\Windows Defender\'
  condition: selection_evt and (selection_svc or (selection_img and not filter_legit_path))
falsepositives:
  - Legitimate Defender platform updates re-registering the KslD service
level: high
```

**Known false positives:**

- Microsoft Defender platform or servicing updates that stage KslD.sys outside System32\drivers
- Security researchers or red teams loading LOLDrivers samples in lab environments

**Tuning notes:** Add Defender platform staging directories observed in your estate to the std_path allow-list, and keep the hash matches unfiltered. Restrict to endpoints with Sysmon EventCode 6 enabled and ensure System 7045 is forwarded. Consider also alerting on any new kernel-type service created outside System32\drivers.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- DefenderKiller [indicator] / [indicator] Vulnerable Driver Load or Kernel Service Install — Exploitation (KQL) (locked: unlock with TL Creds)
- Driver Service Registry Tampering: [indicator] / SharedState / [indicator] (DefenderKiller, KslDump) — Post-Exploitation (KQL) (locked: unlock with TL Creds)
- EDR/AV Process Termination Following Suspicious KSLDriver/KslD Driver Load — Defense Impairment (KQL) (locked: unlock with TL Creds)
- DefenderKiller [indicator] / [indicator] Vulnerable Driver Load or Kernel Service Install — Exploitation (Sigma) (locked: unlock with TL Creds)
- Driver Service Registry Tampering: [indicator] / SharedState / [indicator] (DefenderKiller, KslDump) — Post-Exploitation (Sigma) (locked: unlock with TL Creds)
- EDR/AV Process Termination Following Suspicious KSLDriver/KslD Driver Load — Defense Impairment (Sigma) (locked: unlock with TL Creds)
- Driver Service Registry Tampering: [indicator] / SharedState / [indicator] (DefenderKiller, KslDump) — Post-Exploitation (SPL) (locked: unlock with TL Creds)
- EDR/AV Process Termination Following Suspicious KSLDriver/KslD Driver Load — Defense Impairment (SPL) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (2 of 13)

Defanged, TLP:CLEAR.

- File hash: `d5764d24e78914ab2a9db6b24e323342d0b37998f43add1a9e49b00992b0d645`
- File hash: `b316425d6f200244a25bd7b9998d9c43`

Full set of 13 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [DefenderKiller: How Vulnerable Drivers Are Being Abused to Disable Endpoint Security](https://flashpoint.io/blog/defenderkiller-how-vulnerable-drivers-are-being-abused-to-disable-endpoint-security/)
- [Born to Defend, Weaponized to Kill: Weaponizing Microsoft's Own Driver to Kill EDRs (Jehad Abudagga)](https://medium.com/@jehadbudagga/born-to-defend-weaponized-to-kill-weaponizing-microsofts-own-driver-to-kill-edrs-af4b85c1a43c)
- [LOLDrivers PR #283 - KslD.sys (Microsoft Malware Protection Kernel Support Driver)](https://github.com/magicsword-io/LOLDrivers/pull/283)
- [KslKatz (S1lkys) - KslD.sys abuse tooling](https://github.com/S1lkys/KslKatz)
- [KslDump (andreisss) - LSASS dumping via KslD.sys registry edit](https://github.com/andreisss/KslDump)
- [How KslDump Uses a Microsoft Driver to Bypass PPL and Dump LSASS Credentials via Registry Edit](https://www.besthub.dev/articles/how-ksldump-uses-a-microsoft-driver-to-bypass-ppl-and-dump-lsass-credentials-via-registry-edit-3c40a1c05f4a)
- [Reversing Windows Defender Vulnerable Driver: KslD.sys](https://medium.com/@s12deff/reversing-windows-defender-vulnerable-driver-ksld-sys-d64a485ee8e8)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4769