Stopping attackers who want your endpoint protection to go dark

Most people picture a cyberattack as something loud: files encrypting, screens locking, a ransom note. But the attacks that do real damage usually start quietly. 

Before an attacker steals data or deploys ransomware, they try to make sure nobody is watching. That means dealing with the endpoint protection on the device first.

The tools built for this job have a blunt name in the security industry: EDR Killers. Understanding how they work, and why they are harder to stop than they sound, explains a lot about what effective protection needs to do.

Why do attackers go after your endpoint protection?

Modern endpoint protection performs two high-level jobs. It blocks attacks it recognizes, and it records what happens on the device so suspicious behavior can be detected and investigated. That second job is called endpoint detection and response (EDR).

Both get in an attacker's way. If the protection is running, the exploit technique or the ransomware gets blocked. If the recording is running, the intrusion gets noticed. 

So, attackers treat security software the way a burglar treats a security camera: they deal with it before doing anything else. A common early step in a hands-on intrusion is to weaken or shut down the security software, then carry on with the real attack while the device is blind.

An EDR Killer is any tool built for that purpose. Some are malware written for the job. Others are repurposed legitimate software. Sophos X-Ops has seen the same EDR Killer, rebuilt for each attack, used ahead of ransomware from several competing groups. They all share the same goal: switch off the defenses, then proceed.

Bring your own vulnerable driver

Endpoint protection runs with high privileges, so an ordinary process cannot simply terminate it. To do that, an attacker needs help from the Windows kernel, the most privileged level of the operating system.

One of the most common ways to get that help is a technique called Bring Your Own Vulnerable Driver (BYOVD). A driver is a small piece of software that lets Windows communicate with hardware or other low-level components, and drivers run inside the kernel. Windows only loads drivers that have been digitally signed by a trusted publisher. The problem is that some legitimately signed drivers, often older ones, contain vulnerabilities that let whoever loads them do far more than the driver was designed for.

The attacker does not need to break the rules. They bring a real, signed, trusted driver along with them, install it on the victim's device, and then use its vulnerability to make the driver act on their behalf. Because the driver runs in the kernel, it can do what an ordinary process cannot, such as forcibly closing the endpoint protection processes. The driver is not malware. It is a legitimate component being used for an illegitimate purpose, so tools that look for malicious files have nothing to find.

What good protection looks like

A single defense against EDR Killers is not enough, because attackers have more than one way in. Protection must cover the attack from several angles at once.

Many EDR Killers, and the drivers they rely on, are already known, and reputation-based protection should stop them on sight. A driver known to be exploitable should be blocked outright, by default, because there is rarely a good reason to let it load. That block should not depend on the attack unfolding in one specific sequence first.

Attackers also change their tools, so protection must judge behavior as well as identity. How a program interacts with a driver, and what else is happening on the device at the time, should count as much as which driver it is.

Not every EDR Killer needs a vulnerable driver, either. Some borrow the signed drivers that ship with legitimate security testing tools, and some leave the protection running and attack the recording instead. Protection must cover those routes as well.

A determined attacker who is blocked once will try again. Protection should respond to repeated attempts by tightening its defenses, rather than waiting for the next move. 

Finally, protection against the attacker's end goal, such as ransomware, should run independently of the processes EDR Killers target. That way, it keeps working even if an attacker gets further than they should.

How Sophos Endpoint stops EDR Killers

Sophos Endpoint uses several complementary layers of defense against EDR Killers, each covering a different point in the attack.

The first line of defense deals with what Sophos has already seen. Reputation-based protection blocks known EDR Killer tools and suspicious files, drawing on threat intelligence gathered across the 300,000+ organizations using Sophos Endpoint worldwide. Known vulnerable drivers are blocked too, through a "Block vulnerable drivers" policy setting in Sophos Endpoint that is enabled by default on every protected device. The driver itself is the signal, so it is blocked before it can be used against Sophos Endpoint, whatever sequence the attack follows.

This works because of something attackers cannot easily change. A vulnerable driver must be legitimately signed to load at all, so the attacker cannot modify the file without breaking the signature. Its unique fingerprint (a cryptographic hash) stays the same, whatever the attacker renames it to. Sophos X-Ops threat intelligence keeps expanding the list of blocked drivers as new research and customer investigations confirm them, and the updates reach customers without a product update. If a particular driver is needed for legitimate business reasons, administrators can authorize it.

A vulnerable driver is not dangerous on its own. It only becomes useful to an attacker when something starts giving it orders. That usually happens through a standard Windows interface, and it is the point at which the attack becomes visible. Sophos Endpoint watches for exactly that pattern. A process that installs a driver and immediately begins sending it commands is behaving suspiciously, and Sophos weighs that against what else it knows about the process: where it came from, where it is running from, and what else it has been doing. An attempt to turn a signed driver against your endpoint protection is judged by what it is trying to do, not just by which driver it happens to be using. That matters, because the attacker can always bring a different driver. Tamper Protection adds kernel-level self-defense against EDR Killers that use vulnerable drivers.

Vulnerable drivers are not the only drivers attackers borrow. Some legitimate penetration-testing tools ship with their own signed drivers, and attackers misuse those drivers in the same way. A companion setting, "Block security tool drivers", stops them on the same principle: the driver is known, its fingerprint cannot change, and it is blocked before it loads. Tamper Protection gives Sophos Endpoint kernel-level self-defense against EDR Killers that use vulnerable drivers.

Sophos Endpoint also watches how programs use drivers, evaluating that activity against everything else happening on the device, so attempts to turn a signed driver against the security software are judged by their behavior, not only by the driver's identity.

Not every attempt to blind a device goes through a driver. Some attackers leave the protection running and go after the recording instead, tampering with Event Tracing for Windows (ETW), the stream of events that Windows produces and that security software, Sophos Endpoint included, relies on to see what is happening. The "Prevent ETW tampering" setting in Sophos Endpoint blocks those attempts, so the device keeps reporting while it is under attack.

When an attacker keeps trying, protection tightens. Repeated EDR Killer behavior is one of the signals that automatically switches on Adaptive Attack Protection, which enables stricter defenses on that device while the attack is underway. And CryptoGuard, the Sophos Endpoint ransomware protection, runs as a filter driver inside the kernel, separate from the endpoint protection processes EDR Killers typically attempt to terminate. Even an attacker who gets past the earlier layers cannot reliably encrypt data. In 2024, attackers behind an attempted RansomHub attack tried to switch off Sophos protection with an EDR Killer called EDRKillShifter. The tool failed, and the ransomware they ran next failed when it triggered CryptoGuard.

Some organizations want to go further on devices that rarely change, such as domain controllers and other servers. For those devices, Sophos Endpoint offers a setting called "Detect new kernel drivers." When it is enabled, every new kernel driver installed on the device is recorded as an event, and administrators can combine those events with custom detection rules to raise an alert or open a case, such as a high-severity case whenever a new driver appears on a domain controller. The setting is off by default, because on an everyday workstation new drivers are routine and the events would be noise. On a device that should not change, a new driver is worth a look.

What this looks like in practice: seven attempts, seven blocks

A recent incident at a Sophos customer shows the layers working together.

An attacker tried to load a legitimately signed but vulnerable driver on a protected device. When the load was blocked, they renamed the file to look like a normal Windows component and tried again and again. Over 76 minutes, the same driver was presented under seven different Windows-like filenames.

Every attempt was blocked. The filename changed seven times, but the driver’s fingerprint never did, so the default-on policy caught each one.

The repeated attempts contributed to Adaptive Attack Protection switching on automatically for the device. When the attacker later tried a different approach, using a registry change to disable Microsoft Defender, that was blocked too.

The vulnerable driver never loaded. After a final round of reconnaissance, no further malicious activity was observed on the device.

Conclusion

Attackers go after security software first because everything else they want to do depends on nobody watching. Sophos Endpoint is built with that in mind: known tools are stopped on sight, known vulnerable drivers and the drivers that ship with penetration-testing tools are blocked, driver abuse is judged by its behavior, the recording the various protection products depend on is guarded, defenses tighten when an attack persists, and the protection that matters most runs separately from what EDR Killers target. Organizations that want a stricter posture on servers can flag every new driver that appears.

If you are evaluating endpoint protection, ask your vendor how they handle a legitimately signed driver being used against you. 

To learn more about Sophos Endpoint and start a free trial, visit sophos.com/endpoint.