Intel: BYOVD Ransomware (Qilin/Warlock) & Storm-1175 Rapid Attacks — April 2026

---
title: Potential BYOVD EDR Bypass via Vulnerable Driver Load
id: 98765432-1234-5678-1234-567812345678
description: Detects the loading of known vulnerable drivers often used in BYOVD attacks to disable security solutions.
status: experimental
date: 2026/04/14
author: Security Arsenal
references:
    - https://thehackernews.com/2026/04/qilin-and-warlock-ransomware-use.html
tags:
    - attack.defense_evasion
    - attack.t1068
logsource:
    product: windows
    definition: 'Sysmon must be configured with Driver Load logging enabled (Event ID 6).'
detection:
    selection:
        EventID: 6
        ImageLoaded|contains:
            - 'RTCore64.sys'
            - 'dbutil_2_3.sys'
            - 'Capcom.sys'
            - 'AsIO.sys'
            - 'mhyprot2.sys'
    condition: selection
falsepositives:
    - Legitimate use of these drivers by specific hardware tools (rare in enterprise servers)
level: critical
---
title: Suspicious Process Termination of EDR Processes
id: abcdefgh-1234-5678-1234-567812345678
description: Detects attempts to terminate common EDR/AV processes, often seen in Qilin and Warlock attacks after BYOVD execution.
status: experimental
date: 2026/04/14
author: Security Arsenal
tags:
    - attack.defense_evasion
    - attack.t1561.002
logsource:
    product: windows
    category: process_termination
detection:
    selection:
        TargetProcess|contains:
            - 'msmpeng.exe' # Windows Defender
            - 'cb.exe' # Carbon Black
            - 'sentinelone' # SentinelOne
            - 'tamperprotect'
            - 'savui' # Sophos
    filter_legit:
        SourceProcess|contains:
            - 'C:\\Program Files'
            - 'C:\\Windows\\System32\\svchost.exe'
    condition: selection and not filter_legit
level: high
---
title: SharePoint Web Shell Creation via Suspicious File Extension
id: 11111111-2222-3333-4444-555555555555
description: Detects the creation of ASPX files with suspicious naming patterns in SharePoint directories, indicative of Warlock initial access.
status: experimental
date: 2026/04/14
author: Security Arsenal
tags:
    - attack.initial_access
    - attack.t1190
logsource:
    product: windows
    category: file_create
detection:
    selection_path:
        TargetFilename|contains:
            - 'C:\\inetpub\\wwwroot\\wss'
            - '\\\\\\\\\\\inetpub\\wwwroot'
    selection_extension:
        TargetFilename|endswith:
            - '.aspx'
            - '.ashx'
    selection_keywords:
        TargetFilename|contains:
            - 'shell'
            - 'upload'
            - 'eval'
            - 'test'
    condition: all of selection_
level: medium

// Hunt for BYOVD Driver Loads and Subsequent EDR Tampering
let VulnerableDrivers = dynamic(["RTCore64.sys", "dbutil_2_3.sys", "Capcom.sys", "AsIO.sys", "mhyprot2.sys"]);
DeviceProcessEvents
| where Timestamp > ago(3d)
| where FileName in~ ("cmd.exe", "powershell.exe", "rundll32.exe")
| where ProcessCommandLine has_any ("-sc", "start", "load") 
| join kind=inner (DeviceEvents 
    | where ActionType == "DriverLoad" 
    | where FileName in~ (VulnerableDrivers)
    ) on DeviceId
| project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, AdditionalFields
| order by Timestamp desc

<#
.SYNOPSIS
    Checks for loaded drivers associated with BYOVD EDR bypass techniques.
.DESCRIPTION
    This script enumerates currently loaded kernel drivers and checks the signatures
    and filenames against a known list of vulnerable drivers abused by Qilin/Warlock.
#>

$VulnerableSignatures = @(
    "ASUSTeK Computer Inc.",
    "GIGABYTE TECHNOLOGY CO., LTD.",
    "Micro-Star International Co., Ltd.",
    "ASIX Electronics Corporation",
    "Capcom Co., Ltd."
)

$VulnerableFiles = @(
    "RTCore64.sys", 
    "dbutil_2_3.sys", 
    "Capcom.sys", 
    "AsIO.sys", 
    "mhyprot2.sys"
)

Write-Host "[+] Scanning for potentially vulnerable BYOVD drivers..." -ForegroundColor Yellow

Get-WmiObject Win32_SystemDriver | Where-Object { $_.State -eq "Running" } | ForEach-Object {
    $DriverName = $_.DisplayName
    $Path = $_.PathName
    $Signer = (Get-AuthenticodeSignature $Path -ErrorAction SilentlyContinue).SignerCertificate.Subject
    
    if ($VulnerableFiles -contains (Split-Path $Path -Leaf)) {
        Write-Host "[!] SUSPICIOUS FILE FOUND: $Path" -ForegroundColor Red
        Write-Host "    Signer: $Signer" -ForegroundColor Red
    }
    elseif ($Signer -and ($VulnerableSignatures | Where-Object { $Signer -match $_ })) {
        Write-Host "[!] SUSPICIOUS SIGNER FOUND: $Path signed by $Signer" -ForegroundColor Red
    }
}

Write-Host "[+] Scan complete." -ForegroundColor Green


---