Listen to this Post
Introduction:
Endpoint Detection and Response (EDR) systems are the frontline defenders in modern cybersecurity, but attackers have shifted tactics—using legitimate administrative tools and living-off-the-land binaries (LOLBins) to disable or kill EDR agents without triggering traditional alarms. MagicSword’s approach focuses on defending the EDR itself, proactively stopping “EDR killers” that exploit trusted drivers (LOLDrivers) and remote management tools (LOLRMM) before they ever execute.
Learning Objectives:
- Understand how attackers leverage LOLDrivers and LOLRMM to terminate EDR processes.
- Learn detection and prevention techniques for EDR-killer behaviors on Windows and Linux.
- Implement hands-on commands, configurations, and simulation steps to harden EDR against living-off-the-land attacks.
You Should Know:
1. Understanding EDR Killers and Living‑off‑the‑Land Binaries
EDR killers are not malware in the traditional sense—they are trusted executables, drivers, or scripts that adversaries repurpose to stop security agents. For example, a vulnerable driver (LOLDriver) can be abused to terminate a protected EDR process, while legitimate RMM tools (LOLRMM) can be used to uninstall agents remotely. MagicSword’s research highlights that this gap—“tools malicious by use, not by nature”—has been ignored by many vendors, leaving EDRs exposed.
Step‑by‑step guide to identifying potential EDR killers on a Windows system:
- List all loaded drivers and check for known vulnerable ones:
Get-WinEvent -FilterHashtable @{LogName='System'; ID=7045} | Select-Object -Property Message - Use `driverquery.exe /v` to enumerate drivers and cross‑reference with public LOLDrivers lists (e.g., from LOLDrivers project).
- Monitor for processes attempting to open handles to EDR services with `PROCESS_TERMINATE` or `PROCESS_SUSPEND_RESUME` access:
Get-Process | Where-Object {$_.Modules.ModuleName -match "edr_sensor"} - On Linux, check for unprivileged users abusing `ptrace` or kernel modules:
sudo auditctl -a always,exit -F arch=b64 -S ptrace -k edr_protection
2. Detecting LOLDrivers and LOLRMM on Windows
LOLDrivers (Living‑Off‑the‑Land Drivers) are signed, legitimate drivers that contain vulnerabilities allowing arbitrary read/write to kernel memory—perfect for killing EDR processes. LOLRMM tools like AnyDesk, TeamViewer, or Splashtop can be silently installed to uninstall security agents. Detection requires monitoring driver load events and unexpected RMM execution.
Step‑by‑step detection commands and configurations:
1. Enable driver load auditing:
auditpol /set /subcategory:"Driver Load" /success:enable /failure:enable
2. Use Sysmon (Event ID 6) to log driver loads and filter against known vulnerable driver hashes:
<DriverLoad onmatch="include"> <Hash condition="contains">md5_of_vulnerable_driver</Hash> </DriverLoad>
3. Hunt for RMM tools connecting to external C2 with network connections:
Get-1etTCPConnection -State Established | Where-Object {$<em>.LocalPort -gt 1024 -and $</em>.RemotePort -eq 443}
4. Block unsigned or suspicious driver installation via Group Policy:
– `Computer Configuration → Windows Settings → Security Settings → Local Policies → Security Options → “Devices: Prevent users from installing printer drivers”` – extend with Device Guard/D-Hardware.
5. Create a PowerShell script to periodically check for new services created by RMM binaries:
Get-CimInstance -ClassName Win32_Service | Where-Object {$<em>.PathName -like "teamviewer" -or $</em>.PathName -like "anydesk"}
- Hardening EDR Against Process Termination (Linux & Windows)
Attackers often use built‑in system tools to kill EDR: `taskkill` / `TerminateProcess` on Windows, or `kill -9` and `systemctl stop` on Linux. Hardening must focus on access control, process protections, and defensive drivers that block termination requests.
Step‑by‑step hardening guide:
Windows:
- Set EDR process as a critical system process (requires driver support). Example using a kernel driver to call `ZwSetInformationProcess` with
BreakOnTermination:// Pseudo – in practice use MagicSword’s or similar protection driver ZwSetInformationProcess(NtCurrentProcess(), ProcessBreakOnTermination, &info, sizeof(info));
- Disable `SeDebugPrivilege` for non‑admins to prevent handle duplication attacks:
secedit /export /cfg sec.conf Edit sec.conf: SeDebugPrivilege = no one secedit /configure /db secedit.sdb /cfg sec.conf /areas USER_RIGHTS
- Block `taskkill` via Software Restriction Policies or AppLocker for sensitive directories.
Linux:
- Make EDR process unkillable using
init/systemd andOOMScoreAdjust:sudo systemctl edit edr_sensor.service Add: [bash] OOMScoreAdjust=-1000
- Protect from
ptrace‑based termination by setting `kernel.yama.ptrace_scope=2` in/etc/sysctl.conf:echo "kernel.yama.ptrace_scope=2" | sudo tee -a /etc/sysctl.conf sudo sysctl -p
- Use Linux Security Modules (AppArmor/SELinux) to block termination signals to the EDR PID:
sudo aa-complain /etc/apparmor.d/edr_sensor Profile contains: deny /proc//status w,
4. Simulating EDR Killer Attacks for Testing
To properly defend, security teams must simulate how adversaries kill EDR. Use controlled lab environments with proof‑of‑concept tools that abuse LOLDrivers (e.g., `Terminator` driver) or LOLRMM (e.g., `uninstall` commands over RMM). MagicSword recommends red‑team exercises focused on “defending the defender.”
Step‑by‑step simulation (Windows only – authorized environments):
- Compile or download a vulnerable driver proof‑of‑concept (e.g., the `gdrv.sys` abuse). Load it:
sc.exe create VulnerableDriver binPath= C:\path\vuln_driver.sys type= kernel sc.exe start VulnerableDriver
- Use a tool like `NtTerminateProcess` via direct syscall (C example):
[DllImport("ntdll.dll")] static extern int NtTerminateProcess(IntPtr ProcessHandle, int ExitStatus); // Obtain handle with PROCESS_TERMINATE rights from EDR PID - Simulate LOLRMM – silently install AnyDesk and attempt remote uninstall:
msiexec /i AnyDesk.msi /quiet & 'C:\Program Files (x86)\AnyDesk\AnyDesk.exe' --uninstall --silent
- Monitor MagicSword’s prevention logs: the product should block the driver load or kill attempt and alert.
- Tear down the lab and revert to snapshot.
5. MagicSword’s Approach and Configuration Tips
Jose Hernandez, Prevention Lab LIVE: “We want to defend the EDR as well. We specifically have an entire piece of our product designed to stop EDR killers from ever running.” MagicSword achieves this by:
– Hooking kernel callbacks to validate driver load requests against a community‑sourced LOLDrivers database.
– Using user‑mode API hooks on TerminateProcess, NtRaiseHardError, and RMM uninstall routines.
– Providing a “defense mode” that quarantines any binary attempting to open a handle to EDR with termination rights.
Configuration best practices:
- Enable MagicSword’s LOLDriver blocklist from the management console →
Policies → Driver Protection → Enable Community Blocklist. - Set RMM oversight to `Alert on new RMM installation` and
Block silent uninstall. - Deploy via GPO or script to all endpoints:
Silent install MagicSword agent msiexec /i MagicSword.msi /qn MAGIC_KEY=your_license /lv install.log
- Integrate with SIEM – forward events for LOLDriver detection:
wevtutil epl "MagicSword-LOLDriver" C:\logs\magic_drivers.evtx
- Test weekly using the simulation steps in section 4 – MagicSword’s dashboard will show “blocked EDR killer attempts”.
What Undercode Say:
- Key Takeaway 1: Defending the EDR itself is not optional—attackers have moved from malware to legitimate tools (LOLDrivers, LOLRMM) to kill security agents, and most organizations lack visibility into these “gray‑area” threats.
- Key Takeaway 2: MagicSword’s community‑driven intelligence (10,000+ researchers) proves that open‑source collaboration is essential to keep up with the ever‑growing list of vulnerable drivers and RMM abuse techniques.
Analysis: The cybersecurity industry has long focused on preventing malware execution, but the blind spot has always been trusted software turned weapon. By prioritizing EDR self‑defense, MagicSword addresses a fundamental weakness: if an attacker can kill your EDR, all other layers fail. The technical approach—kernel callbacks, handle protection, and live blocklisting—mirrors how endpoint security should evolve. The mention of “why we almost didn’t” suggests commercial challenges, but the need is undeniable. For blue teams, this means reallocating detection engineering to monitor driver loads and RMM telemetry, not just file hashes.
Prediction:
- +1 MagicSword’s focus on EDR killing will become a standard feature across all major EDR/XDR vendors within 24 months, forcing Microsoft Defender and CrowdStrike to implement similar kernel‑level protection.
- -1 Adversaries will pivot to abusing firmware vulnerabilities and hypervisor‑based rootkits to bypass EDR self‑defense, raising the bar for kernel‑level detection.
- +1 Community‑sourced LOLDriver blocklists will evolve into real‑time threat intelligence feeds, reducing the window between driver disclosure and protection from weeks to hours.
- -1 Small to medium businesses without dedicated security teams will remain exposed because MagicSword‑like solutions require deep system integration and skilled configuration.
- +1 The rise of LOLRMM detection will push RMM vendors to implement tamper‑proof uninstall flows and certificate pinning, inadvertently making the entire ecosystem more secure.
▶️ Related Video (84% Match):
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
IT/Security Reporter URL:
Reported By: Why We – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
