GentleKiller & The Gentlemen: Hunting EDR-Killer BYOVD Attacks

---
title: Potential Suspicious Kernel Driver Load via Service Control
id: 8f4e3d1c-6b7a-4f9e-8c2d-1a5b6c7d8e9f
status: experimental
description: Detects the creation of a kernel driver service using sc.exe, a common method in BYOVD attacks to load vulnerable drivers.
references:
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/06/19
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  category: process_creation
  product: windows
detection:
  selection_sc:
    Image|endswith: '\sc.exe'
  selection_create:
    CommandLine|contains: 'create'
  selection_type:
    CommandLine|contains: 'kernel'
  selection_bin:
    CommandLine|contains: '.sys'
  condition: all of selection_*
falsepositives:
  - Legitimate driver installation by administrators
level: high
---
title: Driver Loaded from User Directory
id: 9a5f2e4d-1c3b-4a8d-9e0f-2b3c4d5e6f7a
status: experimental
description: Detects the loading of kernel drivers (.sys) from user-writable directories (User Profile, AppData, Temp), which is highly suspicious for BYOVD.
references:
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/06/19
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  category: driver_load
  product: windows
detection:
  selection:
    ImageLoaded|endswith: '.sys'
  filter_paths:
    ImageLoaded|contains:
      - '\Windows\System32\drivers\'
      - '\Windows\SysWOW64\drivers\'
  condition: selection and not filter_paths
falsepositives:
  - Rare legitimate software installation
level: critical

// Hunt for processes creating kernel services, specifically sc.exe or PowerShell creating services
let SuspiciousServiceCreation =
    DeviceProcessEvents
    | where Timestamp > ago(7d)
    | where (FileName in~ ('sc.exe', 'powershell.exe', 'cmd.exe') or ProcessVersionInfoOriginalFileName in~ ('sc.exe', 'powershell.exe'))
    | where ProcessCommandLine has 'create' and (ProcessCommandLine has 'kernel' or ProcessCommandLine has '.sys')
    | project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine;
// Hunt for driver loads from suspicious locations (Sysmon Event 6 equivalent in Defender)
let SuspiciousDriverLoad = 
    DeviceImageLoadEvents 
    | where Timestamp > ago(7d)
    | where FileName endswith ".sys"
    | where FolderPath !contains @"C:\Windows\System32\drivers\" and FolderPath !contains @"C:\Windows\SysWOW64\drivers\"
    | project Timestamp, DeviceName, FileName, FolderPath, SHA256, Signed;
// Union and correlate
union SuspiciousServiceCreation, SuspiciousDriverLoad
| summarize count() by DeviceName, bin(Timestamp, 1h)
| where count_ > 0
| order by count_ desc

-- Hunt for loaded drivers that are not in the standard system paths
SELECT Name, Description, Company, Signed, LoadTime, DeviceName
FROM drivers()
WHERE Name =~ "\.sys"
  AND NOT DeviceName =~ "^C:\\Windows\\System32\\drivers\\.*"
  AND NOT DeviceName =~ "^C:\\Windows\\SysWOW64\\drivers\\.*"
-- Add specific checks for known vulnerable drivers if indicators become available

# Enable the Vulnerable Driver Blocklist to mitigate BYOVD attacks
$registryPath = "HKLM:\SYSTEM\CurrentControlSet\Control\CI\Config"
$name = "VulnerableDriverBlocklistEnable"
$value = 1

if (-not (Test-Path $registryPath)) {
    New-Item -Path $registryPath -Force | Out-Null
}

$currentValue = (Get-ItemProperty -Path $registryPath -Name $name -ErrorAction SilentlyContinue).$name

if ($currentValue -ne $value) {
    Set-ItemProperty -Path $registryPath -Name $name -Value $value -Type DWord
    Write-Host "SUCCESS: Vulnerable Driver Blocklist has been enabled." -ForegroundColor Green
} else {
    Write-Host "INFO: Vulnerable Driver Blocklist is already enabled." -ForegroundColor Cyan
}

# Ensure Driver Signature Enforcement is strictly enforced (Prevents OS test signing from being abused)
$ciPath = "HKLM:\SYSTEM\CurrentControlSet\Control\CI"
if ((Get-ItemProperty -Path $ciPath).Policy -ne 0) {
    # Note: Changing CI Policy usually requires reboot and can be disruptive. 
    # This script focuses on the Blocklist which is safer to apply immediately.
    Write-Host "WARNING: Please verify Code Integrity Policies ensure only signed drivers load." -ForegroundColor Yellow
}