Fake LastPass Authenticator Installer Uses Microsoft-Signed Driver to Kill EDR — Detection and Response Guide

---
title: Suspicious Kernel Driver Load from User-Writable or Temporary Path
id: 3f8a1b2c-7d94-4e5b-a6c1-9f2e8d3b4a01
status: experimental
description: Detects loading of a kernel driver (.sys) from user-writable, temporary, or non-standard locations — a hallmark of BYOVD/EDR-killer campaigns such as the fake LastPass Authenticator installer that drops a Microsoft-signed AV-killing driver.
references:
  - https://thehackernews.com/2026/09/fake-lastpass-authenticator-installer.html
  - https://attack.mitre.org/techniques/T1068/
  - https://attack.mitre.org/techniques/T1562/001/
author: Security Arsenal
date: 2026/09/18
tags:
  - attack.defense_evasion
  - attack.t1562.001
  - attack.t1068
logsource:
  category: driver_load
  product: windows
detection:
  selection_path:
    ImageLoaded|contains:
      - '\AppData\'
      - '\Temp\'
      - '\tmp\'
      - '\Downloads\'
      - '\ProgramData\'
      - '\Users\Public\'
      - '\$Recycle.Bin\'
  selection_ext:
    ImageLoaded|endswith: '.sys'
  filter_signed_microsoft_system:
    Signed: 'true'
    ImageLoaded|contains: '\Windows\System32\drivers\'
  condition: selection_path and selection_ext and not filter_signed_microsoft_system
falsepositives:
  - Legitimate software that extracts drivers to ProgramData during installation (rare; verify publisher and install context)
  - Some VPN, anti-cheat, and hardware monitoring tools with poor packaging hygiene
level: high
---
title: Security Product Process Terminated by Non-System Process
id: 8c2d4e6f-1a3b-4c5d-9e7f-2b8a6c4d5e02
status: experimental
description: Detects abnormal termination of antivirus/EDR processes. In the fake LastPass Authenticator campaign, a signed kernel driver kills security software before a password stealer runs. Security tools terminating outside of an expected update/uninstall path is a critical signal.
references:
  - https://thehackernews.com/2026/09/fake-lastpass-authenticator-installer.html
  - https://attack.mitre.org/techniques/T1562/001/
author: Security Arsenal
date: 2026/09/18
tags:
  - attack.defense_evasion
  - attack.t1562.001
logsource:
  category: process_termination
  product: windows
detection:
  selection_target:
    TargetImage|contains:
      - 'MsMpEng.exe'
      - 'MsSense.exe'
      - 'SenseIR.exe'
      - 'SentinelAgent.exe'
      - 'SentinelServiceHost.exe'
      - 'CSFalconService.exe'
      - 'CSFalconContainer.exe'
      - 'cylancesvc.exe'
      - 'bdagent.exe'
      - 'avp.exe'
      - 'ekrn.exe'
      - 'SophosHealth.exe'
      - 'sophossps.exe'
      - 'TaniumClient.exe'
      - 'cb.exe'
      - 'xagt.exe'
      - 'elastic-endpoint.exe'
      - 'elastic-agent.exe'
  filter_parent:
    Image|contains:
      - '\Windows\System32\svchost.exe'
      - '\Windows\System32\wininit.exe'
      - 'MsMpEng.exe'
  condition: selection_target and not filter_parent
falsepositives:
  - Legitimate AV uninstall/upgrade workflows — correlate with authorized change windows and known installer hashes
level: critical
---
title: Suspicious Installer or Downloader Spawning Driver Installation Activity
id: 5e7f9a1b-3c4d-4e5f-8a9b-1c2d3e4f5a03
status: experimental
description: Detects user-context installer-style executables invoking driver/service installation tooling (sc.exe create of kernel services, pnputil, rundll32 installing INF drivers) — consistent with the fake LastPass Authenticator installer staging its signed AV-killer driver.
references:
  - https://thehackernews.com/2026/09/fake-lastpass-authenticator-installer.html
  - https://attack.mitre.org/techniques/T1543/003/
author: Security Arsenal
date: 2026/09/18
tags:
  - attack.persistence
  - attack.defense_evasion
  - attack.t1543.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_sc:
    Image|endswith: '\sc.exe'
    CommandLine|contains|all:
      - 'create'
      - 'type='
    CommandLine|contains:
      - 'kernel'
      - 'binPath='
  selection_pnputil:
    Image|endswith: '\pnputil.exe'
    CommandLine|contains: '/add-driver'
  selection_suspicious_cli:
    CommandLine|contains:
      - '\AppData\'
      - '\Temp\'
      - '\Downloads\'
      - '\Users\Public\'
      - '.sys'
  condition: (selection_sc or selection_pnputil) and selection_suspicious_cli
falsepositives:
  - IT driver deployment scripts — restrict by path and validate against software inventory
  - Hardware vendor updaters with poor path hygiene
level: high

// Hunt 1: Driver loads from user-writable paths + security tool termination (BYOVD / EDR-killer pattern)
let Lookback = 7d;
let SuspiciousDriverLoads =
    DeviceEvents
    | where TimeGenerated > ago(Lookback)
    | where ActionType == "DriverLoad" or (ActionType == "FileCreated" and FileName endswith ".sys")
    | extend DriverPath = coalesce(FolderPath, FileName)
    | where DriverPath has_any ("\\AppData\\", "\\Temp\\", "\\Downloads\\", "\\ProgramData\\", "\\Users\\Public\\")
    | project DeviceId, DeviceName, DriverLoadTime=TimeGenerated, DriverPath, InitiatingProcessFileName, InitiatingProcessCommandLine;
let SecToolTermination =
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where FileName has_any ("MsMpEng.exe","MsSense.exe","SentinelAgent.exe","CSFalconService.exe","cylancesvc.exe","ekrn.exe","sophossps.exe","elastic-endpoint.exe")
       or ProcessCommandLine has_any ("taskkill", "sc stop", "sc delete", "net stop")
    | project DeviceId, SecEventTime=TimeGenerated, FileName, ProcessCommandLine, InitiatingProcessFileName;
SuspiciousDriverLoads
| join kind=inner SecToolTermination on DeviceId
| where SecEventTime between (DriverLoadTime .. DriverLoadTime + 30m)
| project DeviceName, DriverLoadTime, DriverPath, InitiatingProcessFileName, InitiatingProcessCommandLine, SecEventTime, FileName, ProcessCommandLine
| order by DriverLoadTime desc;

// Hunt 2: Executables masquerading as LastPass authenticator downloaded from non-official sources
DeviceFileEvents
| where TimeGenerated > ago(14d)
| where FileName has_any ("lastpass", "authenticator") and FileName endswith_any (".exe", ".msi")
| project TimeGenerated, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated desc;

// Hunt 3: New kernel services registered pointing at suspicious paths
DeviceRegistryEvents
| where TimeGenerated > ago(14d)
| where RegistryKey has @"HKLM\SYSTEM\CurrentControlSet\Services"
| where RegistryValueName == "ImagePath"
| where RegistryValueData has_any ("\\AppData\\", "\\Temp\\", "\\Downloads\\", "\\Users\\Public\\", "\\ProgramData\\")
   and RegistryValueData endswith ".sys"
| project TimeGenerated, DeviceName, RegistryKey, RegistryValueData, InitiatingProcessFileName, InitiatingProcessCommandLine;

-- Hunt: EDR-killer driver artifacts — .sys files in user-writable paths and their service registrations
SELECT FullPath AS DriverFile,
       Size AS DriverSize,
       Mtime AS Modified,
       Btime AS Created
FROM glob(globs=['C:/Users/*/AppData/**/*.sys',
                 'C:/Windows/Temp/**/*.sys',
                 'C:/ProgramData/**/*.sys',
                 'C:/Users/Public/**/*.sys',
                 'C:/Users/*/Downloads/**/*.sys'])
WHERE NOT IsDir
ORDER BY Created DESC

-- Correlate: enumerate running services/drivers whose binary lives outside System32\drivers
SELECT Name, DisplayName, PathName, State, StartMode
FROM wmi(query="SELECT Name, DisplayName, PathName, State, StartMode FROM Win32_SystemDriver")
WHERE PathName =~ '(?i)(appdata|temp|downloads|public|programdata)'
   OR (PathName =~ '\.sys' AND NOT PathName =~ '(?i)system32\\\\drivers')

-- Live view: processes spawned from installer-style paths in the last hour (password stealer execution)
SELECT Pid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Exe =~ '(?i)(appdata\\\\local\\\\temp|downloads|users\\\\public)'
  AND CreateTime > now() - 3600

# === EDR-Killer / Fake LastPass Installer Triage & Hardening Script ===
# Run elevated. Review output before removing anything.

# 1) Find .sys files outside the standard driver store
$suspiciousPaths = @("$env:SystemDrive\Users","$env:SystemDrive\ProgramData","$env:TEMP")
Get-ChildItem -Path $suspiciousPaths -Recurse -Filter *.sys -ErrorAction SilentlyContinue |
  Select-Object FullName, Length, CreationTime, LastWriteTime,
    @{N='Signature';E={(Get-AuthenticodeSignature $_.FullName).Status}},
    @{N='Signer';E={(Get-AuthenticodeSignature $_.FullName).SignerCertificate.Subject}} |
  Format-List

# 2) Enumerate kernel services pointing to non-standard driver paths
Get-CimInstance Win32_SystemDriver |
  Where-Object { $_.PathName -match 'AppData|Temp|Downloads|Public|ProgramData' } |
  Select-Object Name, DisplayName, State, StartMode, PathName | Format-List

# 3) Check Microsoft Defender tamper protection and real-time monitoring status
Get-MpComputerStatus |
  Select-Object IsTamperProtected, TamperProtectionSource, RealTimeProtectionEnabled,
    AntivirusEnabled, AMServiceEnabled, BehaviorMonitorEnabled | Format-List

# 4) Verify Microsoft Vulnerable Driver Blocklist is enforced (blocks revoked/abused signed drivers)
Get-CimInstance -Namespace "root\Microsoft\Windows\Defender" -ClassName MSFT_MpPreference -ErrorAction SilentlyContinue
Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\CI\Config" -Name VulnerableDriverBlocklistEnable -ErrorAction SilentlyContinue
# Expected: VulnerableDriverBlocklistEnable = 1. If missing/0, enforce it:
Set-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\CI\Config" -Name VulnerableDriverBlocklistEnable -Value 1

# 5) Ensure Tamper Protection is on (cannot be set via script — must be enabled in Intune/Defender portal;
#    flag hosts where it is off)
if ((Get-MpComputerStatus).IsTamperProtected -ne $true) {
  Write-Warning "Tamper Protection is DISABLED on this host. Enable via Intune or the Defender portal immediately."
}

# 6) Collect evidence: recent service installs and driver-related events for IR handoff
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045; StartTime=(Get-Date).AddDays(-14)} -ErrorAction SilentlyContinue |
  Select-Object TimeCreated, Message | Format-List
Get-ChildItem "$env:SystemDrive\Users\*\Downloads" -Recurse -Include *lastpass*,*authenticator* -ErrorAction SilentlyContinue |
  Select-Object FullName, CreationTime, @{N='SHA256';E={(Get-FileHash $_.FullName -Algorithm SHA256).Hash}} | Format-List

# 7) If a malicious driver service is identified, stop and delete it (replace SERVICENAME):
# sc.exe stop SERVICENAME
# sc.exe delete SERVICENAME
# Then quarantine the .sys file, isolate the host, and open an IR case — a password stealer
# payload means credential compromise; force resets for any accounts used on the machine.