Gentlemen RaaS: Detecting and Blocking Multi-Vector EDR Killer Toolsets

---
title: Potential EDR Killer - Security Service Termination
id: 9a2b3c4d-5e6f-7g8h-9i0j-1k2l3m4n5o6p
status: experimental
description: Detects attempts to stop security-related services using sc.exe, a common tactic in EDR killer scripts.
references:
  - https://attack.mitre.org/techniques/T1562/001/
author: Security Arsenal
date: 2026/04/08
tags:
  - attack.defense_evasion
  - attack.t1562.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_sc:
    Image|endswith: '\sc.exe'
    CommandLine|contains: ' stop '
  selection_keywords:
    CommandLine|contains:
      - 'security'
      - 'defend'
      - 'sense'
      - 'agent'
      - 'endpoint'
      - 'crowd'
      - 'sentinel'
      - 'sophos'
      - 'tamper'
  condition: all of selection_*
falsepositives:
  - Legitimate administrator restarting security services (rare)
level: high
---
title: Potential EDR Killer - Process Termination Utility
id: b4c5d6e7-f8g9-h0i1-j2k3-l4m5n6o7p8q9
status: experimental
description: Detects the use of taskkill.exe to forcibly terminate processes, commonly used by EDR killers to disable agents.
references:
  - https://attack.mitre.org/techniques/T1562.001/
author: Security Arsenal
date: 2026/04/08
tags:
  - attack.defense_evasion
  - attack.t1562.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\taskkill.exe'
    CommandLine|contains:
      - '/f'
      - '/im'
  filter_generic:
    # This rule requires tuning based on environment, but we look for usage against common agent paths
    CommandLine|contains:
      - '.exe'
  condition: selection and not filter_generic # Placeholder: refine by excluding legitimate IT tools
falsepositives:
  - Helpdesk technicians terminating hung applications
level: medium

// Hunt for suspicious service stop commands and process termination attempts
// Context: Gentlemen RaaS EDR Killer activity
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("sc.exe", "taskkill.exe", "net.exe", "net1.exe")
| where ProcessCommandLine has_any ("stop", "delete", "/f", "/im")
| where ProcessCommandLine has_any ("Defend", "Sense", "Agent", "CrowdStrike", "SentinelOne", "Sophos", "WinDefend", "MsMpEng")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| order by Timestamp desc

-- Hunt for process execution patterns indicative of EDR killers
-- Look for sc.exe stop or taskkill targeting security processes
SELECT Pid, Name, CommandLine, Exe, Username, StartTime
FROM pslist()
WHERE Name =~ 'sc.exe' 
   AND CommandLine =~ 'stop'
   OR Name =~ 'taskkill.exe'
   AND CommandLine =~ '/f'

-- Additionally, hunt for recently modified or loaded unsigned drivers
-- often used in BYOVD attacks associated with EDR killers
SELECT Filename, Mtime, Size, VersionInformation.CompanyName
FROM glob(globs="C:\Windows\System32\drivers\*.sys")
WHERE Mtime < now() - 24h 
   AND SigStatus = "Unsigned"

<#
.SYNOPSIS
    Remediation Script: Audit and Restore Security Services.
.DESCRIPTION
    Checks the status of critical security services and attempts to restart them if stopped.
    Also verifies that the EDR process is active.
#>

# Define critical services to monitor (Add your specific EDR vendor service names here)
$criticalServices = @(
    "WinDefend",       # Microsoft Defender
    "Sense",           # Windows Defender Advanced Threat Protection Service
    "WdNisSvc",        # Windows Defender Antivirus Network Inspection Service
    "SecurityHealthService"
    # Add 3rd party EDR services, e.g., "CrowdStrike Falcon Sensor Service", "SentinelAgent"
)

Write-Host "[+] Initiating Security Service Audit..." -ForegroundColor Cyan

$servicesStatus = Get-Service -Name $criticalServices -ErrorAction SilentlyContinue

foreach ($service in $servicesStatus) {
    if ($service.Status -ne "Running") {
        Write-Host "[!] ALERT: Service $($service.Name) is $($service.Status). Attempting recovery..." -ForegroundColor Red
        try {
            Start-Service -Name $service.Name -ErrorAction Stop
            Write-Host "[+] SUCCESS: Service $($service.Name) restarted." -ForegroundColor Green
        }
        catch {
            Write-Host "[-] FAILURE: Could not restart $($service.Name). Manual intervention required." -ForegroundColor Red
        }
    }
    else {
        Write-Host "[OK] Service $($service.Name) is Running." -ForegroundColor Green
    }
}

# Check for presence of critical EDR processes
$processesToCheck = @("MsMpEng.exe", "SenseCncProxy.exe") # Add vendor specific processes
Write-Host "[+] Verifying EDR Process Integrity..."
Get-Process -Name $processesToCheck -ErrorAction SilentlyContinue | Select-Object ProcessName, Id, Path