Detecting BYO Encryptor and Vulnerable Driver Kills

Ransomware-as-a-service affiliates run their own tooling: an encryptor supplied by the group, often launched by hand, preceded by a step that disables endpoint security. A common method is to load a legitimately signed but vulnerable driver and use it to terminate protected security processes from the kernel. The technique leaves driver-load, service-creation and process-termination events that you can detect before the encryptor runs.

Signals at a Glance

Driver Loads and Kernel Services

The driver has to reach disk and be registered as a service before it can be loaded, which gives two chances to catch it. Sysmon Event ID 6 records the load with the hash and signature status, and System event 7045 records the service installation. The Sigma rule below flags kernel-driver services whose image sits outside the normal driver locations:

title: Kernel Driver Service Installed From Unusual Path
logsource:
  product: windows
  service: system
detection:
  selection:
    EventID: 7045
    ServiceType: 'kernel mode driver'
  filter_normal:
    ImagePath|contains:
      - '\SystemRoot\System32\drivers\'
      - '\Windows\System32\drivers\'
      - '\Program Files\'
  condition: selection and not filter_normal
level: high
# tune/validate: legitimate installers also register drivers; allowlist by vendor and path.

Match loaded driver hashes against a maintained vulnerable-driver list, then look for security-process loss on the same host in the next few minutes. Load the list from a source you trust and refresh it regularly:

// KQL - vulnerable driver load followed by security agent exit
let vulnDrivers = externaldata(Sha256:string)
    [@"https://example.invalid/your-internal-vuln-driver-hashes.csv"]  // host your own copy
    with (format="csv", ignoreFirstRecord=true);
DeviceEvents
| where ActionType == "DriverLoad"
| where SHA256 in~ (vulnDrivers)
| project DriverTime=Timestamp, DeviceId, DeviceName, FileName, SHA256, FolderPath
| join kind=inner (
    DeviceEvents
    | where ActionType in ("AntivirusDisabled", "TamperingAttempt", "ServiceStopped")
    | project TamperTime=Timestamp, DeviceId, ActionType
  ) on DeviceId
| where TamperTime between (DriverTime .. DriverTime + 15m)
// tune/validate: replace the hash source and confirm action-type names in your tenant.

Prevent, Then Detect

• Turn on the Microsoft vulnerable driver blocklist and hypervisor-protected code integrity where your hardware allows. These block known-vulnerable drivers before they load.
• Enable tamper protection in your EDR and alert on every tamper attempt, since it is the strongest evidence that an operator is mid-intrusion.
• Treat a blind EDR agent as an incident. A host that stops reporting without a shutdown event deserves an immediate check from another telemetry source.
• Detect the staging as well. A new, unsigned executable run by hand under an admin account, from a user-writable path, is the encryptor delivery, regardless of whose code it is.