Defending Against 'GodDamn' Ransomware: BYOVD Attacks Exploiting Microsoft-Signed Kernel Drivers

---
title: Potential 'GodDamn' Ransomware Process Execution
id: 8c4d21e9-9a12-4f78-8b3a-1d2f3c4b5e6a
status: experimental
description: Detects the execution of processes associated with the 'GodDamn' encryption-based incident.
references:
 - https://www.darkreading.com/cyberattacks-data-breaches/goddamn-ransomware-byovd-smite-companies
author: Security Arsenal
date: 2026/04/06
tags:
 - attack.execution
 - attack.t1059
logsource:
 category: process_creation
 product: windows
detection:
 selection:
   Image|endswith:
     - '\goddamn.exe'
     - '\encrypt.exe'
   or OriginalFileName:
     - 'goddamn.exe'
condition: selection
falsepositives:
 - Unlikely, highly specific naming convention
level: critical
---
title: Suspicious Service Creation of Kernel Driver (BYOVD Indicator)
id: 9d5e32f0-0b23-4e89-9c4d-1e2f3a4b5c6d
status: experimental
description: Detects the creation of a kernel-mode driver service via sc.exe or PowerShell, a common step in BYOVD attacks.
references:
 - https://www.darkreading.com/cyberattacks-data-breaches/goddamn-ransomware-byovd-smite-companies
author: Security Arsenal
date: 2026/04/06
tags:
 - attack.privilege_escalation
 - attack.t1543.003
logsource:
 category: process_creation
 product: windows
detection:
 selection_sc:
   Image|endswith:
     - '\sc.exe'
   CommandLine|contains:
     - 'create'
     - 'type= kernel'
 selection_ps:
   Image|endswith:
     - '\powershell.exe'
     - '\pwsh.exe'
   CommandLine|contains:
     - 'New-Service'
     - 'Kernel'
condition: 1 of selection_*
falsepositives:
 - Legitimate installation of hardware drivers or VPN software
level: medium
---
title: Termination of Security Processes via Driver/Kernel Context
id: a1f4c5e6-2b3d-4e5f-8a7b-9c0d1e2f3a4b
status: experimental
description: Detects the termination of critical security processes which may indicate a kernel-level kill switch used in BYOVD attacks.
references:
 - https://www.darkreading.com/cyberattacks-data-breaches/goddamn-ransomware-byovd-smite-companies
author: Security Arsenal
date: 2026/04/06
tags:
 - attack.defense_evasion
 - attack.t1562.001
logsource:
 category: process_termination
 product: windows
detection:
 selection:
   TargetImage|endswith:
     - '\MsMpEng.exe'
     - '\SenseCncProxy.exe'
     - '\cb.exe'
     - '\DsAgent.exe'
     - '\360sd.exe'
   SourceImage|endswith:
     - '\System'
     - '\services.exe'
     - '\lsass.exe'
condition: selection
falsepositives:
 - Rare, usually indicates system crash or legitimate service restart
level: high

// Hunt for 'GodDamn' ransomware processes and unusual driver loading behavior
let ProcessList = dynamic(['MsMpEng.exe', 'SenseCncProxy.exe', 'cb.exe', 'DsAgent.exe']);
DeviceProcessEvents
| where Timestamp > ago(7d)
// 1. Direct detection of the named threat
| where FileName in~ ('goddamn.exe', 'encrypt.exe')
| union (
    DeviceProcessEvents
    // 2. Detection of service creation for kernel drivers (BYOVD)
    | where ProcessVersionInfoOriginalFileName == "sc.exe" or FileName == "sc.exe"
    | where ProcessCommandLine has "create" and ProcessCommandLine has "kernel"
)
| union (
    DeviceProcessEvents
    // 3. Detection of security process termination
    | where ActionType in ("ProcessTerminated", "TaskKill")
    | where FileName in~ ProcessList
    | extend TerminatedBy = InitiatingProcessFileName
)
| project Timestamp, DeviceName, ActionType, FileName, ProcessCommandLine, InitiatingProcessFileName, SHA256
| order by Timestamp desc

-- Hunt for 'GodDamn' ransomware artifacts and Kernel Mode drivers
-- 1. Hunt for the specific ransomware executable
SELECT Pid, Name, Exe, Cmdline, Username
FROM pslist()
WHERE Name =~ 'goddamn'
   OR Exe =~ 'goddamn'

-- 2. Hunt for drivers loaded from non-standard paths (User profile or Temp)
-- BYOVD often drops drivers in temp directories before loading
SELECT Name, DeviceName, ImagePath, Company, Signed
FROM drivers()
WHERE NOT ImagePath =~ C:\Windows\System32\drivers\
   AND NOT ImagePath =~ C:\Windows\System32\DriverStore\

<#
.SYNOPSIS
    Hardens endpoints against BYOVD attacks and checks for 'GodDamn' indicators.
.DESCRIPTION
    This script enables the Microsoft Vulnerable Driver Blocklist, which is the
    primary defense against the mis-signed driver used in the 'GodDamn' incident.
    It also scans for the presence of the ransomware process.
#>

Write-Host "[+] Checking for 'GodDamn' ransomware processes..."
$maliciousProcesses = Get-Process | Where-Object { $_.ProcessName -like '*goddamn*' -or $_.ProcessName -like '*encrypt*' }

if ($maliciousProcesses) {
    Write-Host "[!] THREAT DETECTED: Malicious process found. Terminating." -ForegroundColor Red
    $maliciousProcesses | Stop-Process -Force
    # Trigger incident response workflow here
} else {
    Write-Host "[+] No malicious processes detected." -ForegroundColor Green
}

Write-Host "[+] Configuring Vulnerable Driver Blocklist (Memory Integrity)..."
try {
    # Check current status
    $ci = Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" -ErrorAction SilentlyContinue
    
    if ($ci -and $ci.Enabled -eq 1) {
        Write-Host "[+] Vulnerable Driver Blocklist is already enabled." -ForegroundColor Green
    } else {
        # Enable Memory Integrity (requires reboot)
        if (-not (Test-Path "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity")) {
            New-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" -Force | Out-Null
        }
        Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" -Name "Enabled" -Value 1 -Type DWord
        Write-Host "[+] Vulnerable Driver Blocklist enabled. A system reboot is required to apply changes." -ForegroundColor Cyan
    }
} catch {
    Write-Host "[-] Error configuring registry: $_" -ForegroundColor Red
}

Write-Host "[+] Verifying Windows Update status for latest security intelligence..."
# Ensure system is up to date to receive the latest driver blocklist revocations
$wuSession = New-Object -ComObject Microsoft.Update.Session
$wuSearcher = $wuSession.CreateUpdateSearcher()
$wuResult = $wuSearcher.Search("IsInstalled=0 and Type='Software' and IsHidden=0")

if ($wuResult.Updates.Count -gt 0) {
    Write-Host "[!] Important updates are pending. Please patch immediately." -ForegroundColor Yellow
} else {
    Write-Host "[+] System appears up to date." -ForegroundColor Green
}