TL;DR

The EDR-killer ecosystem has industrialized. Security researchers have catalogued 90 active tools purpose-built to terminate endpoint detection and response (EDR) agents before ransomware executes. The dominant technique remains Bring Your Own Vulnerable Driver (BYOVD) — over 50 tools, 35 distinct driver victims — but a second wave of driverless evasion tools (EDRSilencer, EDR-Freeze) is emerging that bypasses even BYOVD-hardened environments. Ransomware operators including Qilin have made EDR termination a first step in their kill chain, not an afterthought. Meanwhile, CVE-2026-33825 (Windows Defender TOCTOU race, CVSS 7.8) handed attackers a second path: weaponize the defender itself via BlueHammer/RedSun/UnDefend — with exploitation confirmed in the wild as of April 2026. The attack has matured beyond cat-and-mouse. This is now an industrial adversarial product line. Defending against it requires rethinking the assumption that EDR will always be your last line of visibility.

---

Background: From Evasion to Erasure

For roughly a decade, the cybersecurity industry's answer to malware evasion was behavioral detection — move beyond signatures, watch what processes do. Endpoint Detection and Response platforms became the crown jewel of enterprise security stacks, ingesting kernel telemetry, detecting injection, flagging anomalous child processes. Ransomware operators noticed.

The response was not to evade EDR. It was to eliminate it.

The logic is simple: massive file encryption is inherently noisy. You cannot easily make ransomware silent. But you can kill the observer before you make noise. This creates a controlled execution window — a brief period of defender blindness during which the encryption payload runs uncontested. Ransomware developers adapted accordingly: keep encryptors simple, robust, and modular. Let the EDR killer handle the hard work.

What emerged is not a technique. It is an ecosystem.

---

Technical Analysis

1. The BYOVD Kill Chain: How PoisonX.sys Terminates CrowdStrike Falcon

BYOVD attacks exploit a structural constraint in 64-bit Windows: Driver Signature Enforcement (DSE) requires all kernel-mode code to carry a valid Microsoft hardware compatibility signature. Since attackers cannot load their own unsigned rootkits, they pivot: find a legitimate, signed driver that contains an exploitable vulnerability, deploy it, and abuse it from user space.

PoisonX.sys is the current exemplar. Identified by Xcitium ThreatLabs in early 2026, it is a Microsoft-signed driver — 0/71 detections on VirusTotal at time of discovery — containing a deliberately minimal but lethal payload:

// PoisonX.sys: Device Dispatcher Loop
NTSTATUS ProcKiller(PVOID Buffer) {
  ULONG PID = atoi((char*)Buffer);
  // Kernel open ignores PPL protection flags
  if (ZwTerminateProcess(PID) == STATUS_SUCCESS) {
    RtlCopyMemory(Out, "ok", 3);
  }
}

Symbolic link: \\.\{F8284233-48F4-4680-ADDD-F8284233}

Kill IOCTL: 0x22E010

The exploit mechanism is elegant in its brutality. From user space, ZwOpenProcess with kernel-mode privileges ignores Protected Process Light (PPL) restrictions — the very mechanism that is supposed to make EDR processes unkillable. A user-mode attacker feeds a PID to the driver via DeviceIoControl; the driver terminates the process from ring 0 and returns "ok." No exploit chain required. No memory corruption. Just a legitimate signed interface doing exactly what attackers need.

The driver was found in 15+ signed variants — indicating active maintenance and distribution through dark-web evasion-as-a-service channels.

Affected EDR: CrowdStrike Falcon (PPL-protected sensor process)

Attack vector: Local, post-privilege-escalation

Detection difficulty: High — signed driver, no AV detection at time of deployment

---

2. The Ecosystem: 90 Tools, Four Technique Classes

Based on analysis of approximately 90 active EDR-killer tools in the wild, four distinct technique families have been identified:

Class A — BYOVD (50+ tools, 35+ abused drivers)

• Load a signed-but-vulnerable driver via NtLoadDriver or service installation
• Exploit IOCTL interface to escalate to kernel privileges
• Terminate EDR processes, disable tamper protection, or flush audit logs
• Well-known abused drivers: WinRing0 (PC health apps), gdrv.sys (Gigabyte), mhyprot2.sys (Genshin Impact anti-cheat), HRSword.exe (legitimate security tool)
• Attribution complexity: same drivers shared across multiple ransomware groups

Class B — Legitimate Tool Hijacking (growing category)

• Anti-rootkits and kernel-mode diagnostic tools repurposed
• Process Hacker, GMER, and related tools can terminate protected processes
• Lower technical barrier for affiliates — requires zero driver exploitation knowledge
• Commoditized via RaaS affiliate packs

Class C — Driverless Evasion (EDRSilencer, EDR-Freeze)

• EDRSilencer: Uses Windows Filtering Platform (WFP) to block EDR process network communications — telemetry and cloud lookups silently fail without the process terminating
• EDR-Freeze: Suspends EDR threads using NtSuspendThread — agent stays alive and shows "healthy" to management console while performing no actual detection
• Especially dangerous: management dashboards report EDR as running while it is functionally blind
• No kernel access required; elevated user-mode privileges sufficient

Class D — Full Eradication (Play group)

• Beyond killing: delete EDR installation from disk
• Modify Windows Firewall to block vendor cloud infrastructure
• Cut internet access to prevent re-enrollment
• EDR cannot be restored remotely; physical or out-of-band access required for recovery

---

3. Qilin Ransomware: EDR Termination as Kill-Chain Step 3

The Qilin ransomware group has made EDR termination a formalized step in their standardized attack playbook, observed in active campaigns throughout April 2026:

Qilin Kill Chain (observed sequence):

1. Initial Access — Phishing, credential stuffing, or exposed RDP/VPN

2. Privilege Escalation — LSASS dump, local exploit, or token impersonation

3. EDR Disabling — EDR processes identified and terminated (BYOVD or tool hijacking)

4. Lateral Movement — PsExec, WMI, or legitimate RMM tool traversal

5. Data Exfiltration — Before encryption to maximize double-extortion leverage

6. Encryption — Ransomware deployment across network shares

Step 3 is no longer optional or situational in Qilin's playbook. The group's pre-encryption reconnaissance consistently includes:

whoami /priv
cmdkey /list  
net group "Domain Admins" /domain
tasklist /svc | findstr "CrowdStrike MsMpEng SentinelAgent"

The final command directly queries for running EDR service names before proceeding. This is hands-on-keyboard activity by skilled operators, not automated worm propagation.

---

4. CVE-2026-33825: When the Defender Becomes the Weapon

A separate attack class emerged with the public disclosure of CVE-2026-33825 — a TOCTOU (time-of-check to time-of-use) race condition in Windows Defender's signature update mechanism. CVSS: 7.8.

The vulnerability chain exploits:

• Defender's file remediation process
• NTFS junctions for path redirection
• Windows Cloud Files API for triggering file operations
• Opportunistic locks (oplocks) to control timing of the race window

The three-tool exploitation suite released publicly:

• BlueHammer — reliable SYSTEM-level privilege escalation; Defender detects as Exploit:Win32/DfndrPEBluHmrBZ but too late
• RedSun — drops EICAR test file to manipulate Defender's remediation cycle; survives April 2026 Patch Tuesday on some configurations
• UnDefend — targets the Defender update mechanism to progressively degrade protection over time; activated via Undef.exe -agressive spawned under Explorer.exe

Patched: April 14, 2026 (Patch Tuesday)

Exploitation status: Active in the wild as of April 22, 2026

Critical gap: RedSun remains effective on some configurations post-patch

Staged payload locations observed: %USERPROFILE%\Pictures\, %USERPROFILE%\Downloads\<nested>\

Common filenames: FunnyApp.exe, RedSun.exe, z.exe (renamed variants)

---

5. AI-Assisted EDR Killer Development

A particularly troubling development: evidence of LLM-assisted evasion tool development in the wild. Analysis of tools attributed to the Warlock ransomware gang revealed:

• Generic code structures typical of LLM output (redundant functions, excessive comments, scenario list files embedded in binaries)
• Automated driver-testing loops: the tool iterates through a known-vulnerable driver list, attempts each BYOVD vector, and proceeds to the next on failure — human expertise replaced by automated trial-and-error
• This materially lowers the skill floor for EDR-killer development and enables faster adaptation when specific drivers get blocklisted

The implication: driver blocklist updates that previously provided weeks of protection may now be bypassed within hours as AI-assisted tooling automatically discovers and tests alternatives.

---

IOCs / Indicators

PoisonX.sys

| Indicator | Value |

|-----------|-------|

| Device symbolic link | \\.\{F8284233-48F4-4680-ADDD-F8284233} |

| Kill IOCTL | 0x22E010 |

| Signature | Microsoft Hardware Compatibility (valid) |

| VirusTotal at discovery | 0/71 |

| Kernel call | ZwTerminateProcess via ZwOpenProcess (PPL bypass) |

BlueHammer/RedSun/UnDefend (CVE-2026-33825)

| Indicator | Value |

|-----------|-------|

| Defender detection name | Exploit:Win32/DfndrPEBluHmrBZ |

| Staged payload paths | %USERPROFILE%\Pictures\, %USERPROFILE%\Downloads\[nested]\ |

| Observed filenames | FunnyApp.exe, RedSun.exe, z.exe, Undef.exe |

| Process tree | Explorer.exe → cmd.exe → Undef.exe -agressive |

| Post-exploit commands | whoami /priv, cmdkey /list, net group |

Qilin Reconnaissance Commands

tasklist /svc | findstr "CrowdStrike MsMpEng SentinelAgent Carbon"
whoami /priv
cmdkey /list
net group "Domain Admins" /domain
wmic service where 'name like "%EDR%"' get name,state

Abused Driver Families (BYOVD, partial list)

• WinRing0x64.sys — PC monitoring tools
• gdrv.sys — Gigabyte driver
• mhyprot2.sys — Genshin Impact anti-cheat
• HRSword.exe — EDR process terminator via legitimate security tool
• PoisonX.sys / PoisonKiller family — multiple signed variants

---

Lyrie Take

The EDR-killer market is the most commercially mature offensive capability in the ransomware economy right now. It has dedicated developers, a tiered pricing model, active support channels, and AI-assisted QA. Defenders are writing detection rules faster than they ever have. Attackers are generating evasion variants faster than defenders can write rules. The arms race math is not in our favor — unless you change the terrain.

The structural problem is that EDR assumes its own integrity. Every detection, every telemetry stream, every alert — all of it presupposes the agent is running and healthy. The moment PoisonX.sys sends IOCTL 0x22E010, that assumption is broken. You lose visibility on the very moment you most need it.

Lyrie's model is different by design. Autonomous cyber defense cannot run on the assumption that any single layer is intact. Our detection logic operates at multiple levels simultaneously — network telemetry, kernel event feeds via independent channels, behavioral graph analysis from remote collectors — so that EDR termination on an endpoint does not create a blind spot. It creates an alert.

The right question for any defender in 2026 is not "is our EDR running?" but "what would we see if our EDR was killed right now, and would we see it fast enough?" If the answer to either part is uncertain, the playbook below is where to start.

---

Defender Playbook

Phase 1 — Immediate Hardening (Week 1)

1. Enable and enforce Vulnerable Driver Blocklist (VDB)

• Windows: Enable HVCI (Hypervisor-Protected Code Integrity) — this prevents unsigned or blocklisted drivers from loading at all
• HVCI renders BYOVD attacks that rely on known-vulnerable drivers inert
• HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\HVCIPolicy = 1
• Verify: msinfo32.exe → "Virtualization-based security" = Running; "Kernel DMA Protection" = On
• Caveat: Some older hardware drivers conflict with HVCI — test in staging before broad rollout

2. Patch CVE-2026-33825 immediately

• Apply April 2026 Patch Tuesday updates across all Windows 10, 11, and Server 2019/2022
• Validate patched state via wmic qfe list | findstr "KB5" (confirm relevant KBs installed)
• RedSun retains partial functionality post-patch on some configurations — confirm Defender version is ≥ 4.18.26040.x

3. Enable Driver Load Event Logging

• Windows Event ID 7045 (new service installed) captures driver installation
• Forward EID 7045 to SIEM immediately; set baseline alert on any new service install
• Alert specifically on: driver installs from user-writable paths (%TEMP%, %APPDATA%, user profile directories)

4. Audit Protected Process Light (PPL) configuration

• Verify EDR vendor has PPL enabled for their sensor process
• CrowdStrike: Falcon PPL mode must be explicitly enabled in policy
• SentinelAgent: PPL enforced by default in v22.x+; verify via tasklist /svc | findstr Sentinel
• Microsoft Defender: MsMpEng.exe runs at PPL-Wintcb level by default on modern builds

---

Phase 2 — Detection Engineering (Week 2)

5. Hunt for EDR Killer Staging Behavior

SIEM/EDR detection rule targets:

# Suspicious driver load from user-writable path
event_id:7045 AND ImagePath:("C:\\Users\\" OR "C:\\ProgramData\\" OR "C:\\Temp\\")

# IOCTL to known device paths
event_type:device_io AND device_name:("F8284233" OR "gdrv" OR "WinRing0")

# EDR service enumeration (pre-kill recon)
process_name:cmd.exe AND command_line:("tasklist" AND ("CrowdStrike" OR "MsMpEng" OR "SentinelAgent"))

# Known BlueHammer/RedSun payload staging
file_path:("\\Pictures\\" OR "\\Downloads\\") AND filename:("FunnyApp.exe" OR "RedSun.exe" OR "Undef.exe" OR "z.exe")

# UnDefend execution pattern
parent:Explorer.exe AND process:cmd.exe AND child_command:("Undef.exe -agressive" OR "Undef.exe -aggressive")

# Post-exploitation credential enumeration
process_name:(whoami.exe OR cmdkey.exe OR net.exe) WITHIN 60s OF any(new_service_installed)

6. Monitor EDR Health Independently

• Deploy an EDR health watchdog on endpoints: lightweight agent or scheduled task that pings EDR management console every 60 seconds
• If EDR process disappears, watchdog generates a network-side alert — independent of the EDR itself
• Cloud-managed EDR platforms (CrowdStrike, SentinelOne) surface agent disconnects in management console; configure immediate page/alert on agent going offline unexpectedly

7. Detect EDRSilencer/EDR-Freeze (Driverless Class)

These tools do not kill the EDR process — they freeze or silence it. The EDR appears running. Detection requires external validation:

• Monitor for WFP filter additions targeting EDR process names: netsh wfp show filters — alert on new filters matching EDR binary paths
• Alert on thread suspension events on EDR processes: ETW ThreadSuspend events targeting MsMpEng.exe, CSFalconService.exe, SentinelAgent.exe
• Canary telemetry: Insert a known-benign but detectable action (e.g., a test EICAR variant write) every 5 minutes; if EDR does not alert within 30 seconds, trigger a health-failure incident

---

Phase 3 — Architecture Hardening (Month 1)

8. Defense-in-Depth: Assume EDR Failure

Stop treating EDR as your last defensive layer. Build assuming it will be killed:

• Network Detection and Response (NDR): Network-level visibility captures C2 beacons, lateral movement, and exfiltration regardless of endpoint EDR status. Attackers who kill EDR still traverse the network.
• Independent kernel telemetry: Tools like Sysmon (Microsoft Sysinternals) operate independently of commercial EDR — deploy alongside, not instead of, EDR
• Deception layer: Deploy honeytokens and honeypot credentials in AD. An attacker enumerating credentials post-EDR kill will trigger these before reaching production assets.
• Immutable log shipping: Ensure logs ship to a remote SIEM/SOAR in real time. By the time EDR is killed, the pre-kill telemetry is already in your SIEM.

9. BYOVD-Specific Mitigations

| Mitigation | Implementation | Effectiveness |

|-----------|----------------|---------------|

| HVCI (Memory Integrity) | Group Policy → Device Guard → Enable | Blocks known-blocklisted drivers entirely |

| WDAC (Windows Defender Application Control) | Deny driver installs via policy | Prevents unauthorized driver loading |

| Attack Surface Reduction Rule | Block abuse of exploited vulnerable signed drivers | Signatures-based; complement with blocklist |

| Microsoft Vulnerable Driver Blocklist | Enable via HVCI or manual blocklist | Must be kept updated |

| Driver Whitelisting | Allow only organization-approved drivers | Highest friction; highest protection |

10. Incident Response: What to Do When EDR Goes Dark

If an EDR agent unexpectedly goes offline:

1. Assume breach, not failure — treat as potential active intrusion, not a software glitch

2. Isolate the host immediately — network containment via switch ACL or cloud security group; do not wait for confirmation

3. Collect forensic image remotely — if host is still network-accessible, initiate memory acquisition immediately (volatility, WinPmem, or vendor tooling via out-of-band management)

4. Check for lateral movement indicators — review NDR/firewall logs for the 60 minutes preceding EDR loss

5. Verify backup integrity — confirm ransomware has not begun staging by checking backup connectivity and file modification timestamps on critical shares

---

Sources

1. Dawn Liphardt / ESET — "EDR Killers: Industrial-Scale Evasion, the Foundation of Attacks" (April 2026): https://www.dawnliphardt.com/edr-killers-industrial-scale-evasion-the-foundation-of-attacks-by/

2. Xcitium ThreatLabs — "Reverse-Engineering a 0-Day: PoisonX BYOVD Driver Bypasses CrowdStrike EDR" (April 2026): https://threatlabsnews.xcitium.com/blog/reverse-engineering-a-0-day-poisonx-byovd-driver-bypasses-crowdstrike-edr/

3. PurpleOps — "CVE-2026-33825 Exploitation Elevates Breach Detection" (April 2026): https://purple-ops.io/blog/cve-2026-33825-defender-exploit-apr-22

4. Seceon/Security Boulevard — "Qilin Ransomware Is Disabling EDR to Evade Detection" (April 2026): https://securityboulevard.com/2026/04/qilin-ransomware-is-disabling-edr-to-evade-detection/

5. Vectra AI — "When the Defender Becomes the Door: BlueHammer, RedSun, and UnDefend in the Wild" (April 2026): https://www.vectra.ai/blog/when-the-defender-becomes-the-door-bluehammer-redsun-and-undefend-in-the-wild

6. SecurityWeek — "Recent Microsoft Defender Vulnerability Exploited as Zero-Day" (April 2026): https://www.securityweek.com/recent-microsoft-defender-vulnerability-exploited-as-zero-day/

7. Microsoft Security — April 2026 Patch Tuesday advisory for CVE-2026-33825

---

Lyrie.ai Cyber Research Division — Senior Analyst Desk