Threat Intel
Threat Actors Target Security Tools: Disabling AV/EDR via Vulnerable Drivers, Tampering, and Malicious Firewall Rules
Recent intelligence shows attackers are actively disabling endpoint protection by exploiting vulnerable drivers, tampering with system components, and injecting malicious firewall rules. Defenders should audit driver integrity, enforce signed‑driver policies, monitor firewall changes, and apply the latest patches to mitigate these tactics.
What Happened
\nAttackers are actively targeting endpoint protection solutions, specifically antivirus (AV) and endpoint detection & response (EDR) agents. They employ three main tactics: exploiting vulnerable device drivers, tampering with system binaries, and inserting malicious rules into the Windows firewall.
\nImpact
\nWhen a driver is compromised or a firewall rule is silently added, the AV/EDR agent can be prevented from starting, blocked from communicating with the cloud, or forced to ignore alerts. This effectively removes the last line of defense on the infected host.
\nMitigations
\n- \n
- Enforce signed‑driver policies and regularly audit all loaded drivers for integrity. \n
- Apply the latest vendor patches for known driver vulnerabilities as soon as they are released. \n
- Configure the firewall to block unauthorized rule changes and monitor for unexpected rule additions. \n
- Use endpoint solutions that detect tampering and alert on driver or binary modifications. \n
Monitoring Recommendations
\nTrack driver load events, hash changes, and firewall rule modifications in real time. Correlate these events with AV/EDR health metrics to surface potential disabling attempts early.
Related vulnerabilities
EDR Killers: How Attackers Exploit Drivers to Disable Endpoint Detection
ESET researchers analyzed nearly 90 EDR‑killer tools used in ransomware campaigns, revealing that attackers routinely deploy vulnerable drivers or driverless tactics to suspend or block EDR software before launching encryption. The study shows driver reuse across unrelated toolsets and highlights the pitfalls of attributing attacks solely by driver signatures. Defenders should monitor driver installation, block unauthorized driver loads, and enforce EDR integrity checks.
Read briefing
BTR Reforged: Turning a Signed Windows Defender Driver into a Kernel‑Level Attack Engine
Checkpoint Research has shown that Microsoft’s own BTR.sys – the Boot‑Time Removal driver used by Windows Defender – can be hijacked to perform arbitrary file and registry operations from Ring 0. By reverse‑engineering the driver’s encrypted transaction format and building a tool called BTR_CLI, researchers demonstrated a kernel‑mode operation primitive that bypasses EDR/AV without exploiting a vulnerability. The study exposes how trusted signed components can become powerful attack tools, urging defenders to scrutinize remediation drivers and implement stricter driver‑loading controls.
Read briefing
Unusual User Agent Strings Reveal Scanning and Exploit Attempts
Recent honeypot logs show attackers using crafted User Agent strings to identify scanning tools, exploit Shellshock, and target NTRIP GPS servers. Defenders should monitor and filter anomalous UAs, patch vulnerable services, and harden NTRIP endpoints.
Read briefing
ShinyHunters Exploits CVE-2026-35273 with WAF Bypass
ShinyHunters (UNC6240) is actively exploiting CVE-2026-35273 in Oracle PeopleSoft, bypassing WAF rules via URL encoding. Defenders should prioritize patching and consider disabling the Environment Management Hub (EMHub).
Read briefing