Cruciferra Crypter: Defending Against BYOVD and Process Ghosting Attacks

---
title: Potential Cruciferra Process Ghosting - Pending Delete Execution
id: 8c2e1a05-d123-4567-8901-234567890abc
status: experimental
description: Detects execution of binaries that may be utilizing Process Ghosting techniques, characterized by file access inconsistencies or rapid deletion flags. This rule targets the specific behavior of executables running from paths or with handles that indicate 'delete pending' states often associated with this evasion.
references:
 - https://attack.mitre.org/techniques/T1564/008/
author: Security Arsenal
date: 2026/07/15
tags:
 - attack.defense_evasion
 - attack.t1564.008
logsource:
 category: process_creation
 product: windows
detection:
 selection:
    CommandLine|contains:
      - 'tax'
      - 'refund'
      - 'income'
      - 'itr'
      - 'form'
    Image|endswith:
      - '.exe'
 condition: selection
falsepositives:
 - Legitimate tax software usage
level: high
---
title: Suspicious Driver Load - BYOVD Indicators
id: 9d3f2b16-e234-5678-9012-345678901bcd
status: experimental
description: Detects the loading of known vulnerable drivers frequently abused in BYOVD attacks. The Cruciferra crypter uses these drivers to kill EDR processes.
references:
 - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/07/15
tags:
 - attack.privilege_escalation
 - attack.defense_evasion
 - attack.t1068
logsource:
 category: driver_load
 product: windows
detection:
 selection:
    Signed|contains: 'Valid'
    Subject|contains:
      - 'ASUSTeK Computer Inc.'
      - 'Micro-Star International'
      - 'GIGABYTE'
    ImageLoaded|endswith:
      - '.sys'
 filter_legit:
    ImageLoaded|contains:
      - 'C:\Windows\System32\drivers\'
 condition: selection and not filter_legit
falsepositives:
 - Legitimate gaming or hardware utility software installation
level: critical

// Hunt for Cruciferra Tax Lures and subsequent BYOVD Driver Loads
let ProcessLures = DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessCommandLine has_any ("tax", "refund", "income", "itr", "assessment")
| where InitiatingProcessFileName !in~ ("winword.exe", "excel.exe", "outlook.exe", "chrome.exe", "msedge.exe") // Focus on direct execution or unusual parents
| project DeviceId, ProcessId, ProcessCommandLine, FolderPath, Timestamp;
DeviceEvents
| where Timestamp > ago(7d)
| where ActionType == "DriverLoaded"
| extend DriverFileName = tostring(parse_(AdditionalFields).DriverName)
| where DriverFileName has ".sys"
| project DeviceId, ActionType, DriverFileName, Timestamp
| join kind=inner (ProcessLures) on DeviceId
| project Timestamp, DeviceId, ProcessCommandLine, DriverFileName
| order by Timestamp desc

-- Hunt for BYOVD Drivers and Suspicious Tax Lures
LET SuspiciousDrivers = SELECT Name
FROM glob(globs='C:\Windows\System32\drivers\*.sys')
WHERE Name =~ 'RTCore64'
   OR Name =~ 'dbutil_2_3'
   OR Name =~ 'gdrv'
   OR Name =~ 'AsIO';

LET TaxLures = SELECT FullPath, Mtime
FROM glob(globs='C:\Users\*\Downloads\*.exe')
WHERE FullPath =~ 'tax'
   OR FullPath =~ 'refund'
   OR FullPath =~ 'itr';

SELECT 'Suspicious Driver Detected' AS AlertType, Name AS Evidence
FROM SuspiciousDrivers

UNION ALL

SELECT 'Suspicious Tax Lure Detected' AS AlertType, FullPath AS Evidence
FROM TaxLures

# Apply Vulnerable Driver Blocklist (Hardening against BYOVD)
$registryPath = "HKLM:\SYSTEM\CurrentControlSet\Control\CI\Config"
$registryName = "VulnerableDriverBlocklistEnable"

if (-not (Test-Path $registryPath)) {
    New-Item -Path $registryPath -Force | Out-Null
}

$currentValue = (Get-ItemProperty -Path $registryPath -Name $registryName -ErrorAction SilentlyContinue).$registryName

if ($currentValue -ne 1) {
    Write-Host "Enabling Vulnerable Driver Blocklist..."
    Set-ItemProperty -Path $registryPath -Name $registryName -Value 1 -Type DWord
    Write-Host "Blocklist enabled. A reboot may be required." -ForegroundColor Green
} else {
    Write-Host "Vulnerable Driver Blocklist is already enabled." -ForegroundColor Green
}

# Hunt for and quarantine suspicious tax-themed executables in user profiles
Write-Host "Scanning for suspicious tax-themed executables..."
$suspiciousFiles = Get-ChildItem -Path "C:\Users\" -Recurse -Include "*.exe" -ErrorAction SilentlyContinue | 
    Where-Object { $_.Name -match 'tax|refund|income|itr' -and $_.Directory -match 'Downloads|Desktop|AppData' }

if ($suspiciousFiles) {
    foreach ($file in $suspiciousFiles) {
        Write-Host "Potentially malicious file found: $($file.FullName)" -ForegroundColor Yellow
        # Remove file (Comment out to audit only)
        # Remove-Item -Path $file.FullName -Force
    }
} else {
    Write-Host "No suspicious tax lures found." -ForegroundColor Green
}