Threat video1:00
DefenderKiller Kills EDR via KslD.sys: Detection & IOCs
DefenderKiller loads Microsoft's KSLDriver.sys to kill EDR processes; 13 IOCs, 9 detection rules and 6 ATT&CK techniques, with a free Splunk SPL rule.
Read the full threat intel for DefenderKiller Kills EDR via KslD.sys: Detection & IOCs →
Chapters
- 0:00The hookLegacy driver PoC kills EDR agents
- 0:04The storyResearcher published DefenderKiller
- 0:11Attack pathA service is created and registry values are pre-set
- 0:23AttributionNo threat actor: this was defensive research.
- 0:28Indicators of compromise7 indicators to hunt: 1 SHA-256 hash, 1 MD5 hash and 2 file names, and more.
- 0:37MITRE ATT&CK techniques6 ATT&CK techniques, from execution to credential access.
- 0:42Remediation4 steps now: Alert on creation of kernel-driver services whose ImagePath points outside.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Legacy driver PoC kills EDR agents
0:05Researcher published DefenderKiller
0:07October revealed thirteen variants
0:11A service is created and registry values are pre-set
0:15The vulnerable driver loads and trusts the caller
0:18Security processes get terminated
0:23No threat actor: this was defensive research.
0:287 indicators to hunt: 1 SHA-256 hash, 1 MD5 hash and 2 file names, and more.
0:386 ATT&CK techniques, from execution to credential access.
0:434 steps now: Alert on creation of kernel-driver services whose ImagePath points outside.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.