54 EDR Killers Use BYOVD to Exploit 34 Signed Vulnerable Drivers and Disable Security

A new ESET analysis examines 54 EDR killer tools that use the BYOVD technique, abusing 34 signed but vulnerable drivers to disable endpoint security before ransomware deployment.

• •BYOVD attacks load legitimate, vendor-signed drivers with known vulnerabilities to gain kernel-mode (Ring 0) privileges, enabling termination of EDR processes and tampering with kernel callbacks.
• •EDR killers are developed by three actor types: closed ransomware groups (DeadLock, Warlock), attackers forking PoC code (SmilingKiller), and underground marketplace vendors (ABYSSWORKER, CardSpaceKiller).
• •Script-based tools using taskkill, net stop, or sc delete, as well as Windows Safe Mode abuse, represent a noisier but occasionally used alternative approach.
• •Emerging driverless killers like EDRSilencer and EDR-Freeze block outbound EDR traffic to induce a 'coma' state without requiring a driver.