Qilin and Warlock BYOVD Attack: Detecting msimg32.dll and EDR Bypass

---
title: Suspicious msimg32.dll Creation Outside System32
id: 8a4f2b1c-9d3e-4f5a-8b2c-1d3e4f5a6b7c
status: experimental
description: Detects the creation of msimg32.dll outside of the legitimate Windows System32 directory, associated with Qilin ransomware side-loading activity.
references:
  - https://thehackernews.com/2026/04/qilin-and-warlock-ransomware-use.html
author: Security Arsenal
date: 2026/04/15
tags:
  - attack.defense_evasion
  - attack.t1574.001
logsource:
  category: file_creation
  product: windows
detection:
  selection:
    TargetFilename|contains: '\\msimg32.dll'
  filter:
    TargetFilename|startswith: 'C:\\Windows\\System32\\'
  condition: selection and not filter
falsepositives:
  - Rare legitimate software installs that bundle local DLLs (unusual for msimg32)
level: high
---
title: Load of Known Vulnerable BYOVD Drivers
id: 9b5g3c2d-0e4f-5g6h-9i0j-1k2l3m4n5o6p
status: experimental
description: Detects the loading of drivers frequently abused in BYOVD attacks to disable EDR solutions. Matches signed but vulnerable drivers.
references:
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/04/15
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  category: driver_load
  product: windows
detection:
  selection:
    Signed|contains:
      - 'ASUSTeK Computer Inc.'
      - 'Micro-Star International'
      - 'GIGABYTE'
      - 'AVERMEDIA TECHNOLOGY, INC.'
      - 'Intel(R) Corporation' # Specific vulnerable versions often targeted
    Hashes|contains:
      # Example partial hashes or file names known to be vulnerable
      - 'RTCore64.sys'
      - 'dbutil_2_3.sys'
      - 'capcom.sys'
      - 'mhyprot2.sys'
  condition: selection
falsepositives:
  - Legitimate installation of hardware utilities or gaming software
level: medium
---
title: Potential EDR Process Termination via Taskkill or PowerShell
id: 1c2d3e4f-5a6b-7c8d-9e0f-1a2b3c4d5e6f
status: experimental
description: Detects attempts to terminate common EDR/AV process names, often seen in BYOVD and ransomware operations after driver load.
references:
  - https://thehackernews.com/2026/04/qilin-and-warlock-ransomware-use.html
author: Security Arsenal
date: 2026/04/15
tags:
  - attack.impact
  - attack.t1489
logsource:
  category: process_creation
  product: windows
detection:
  selection_kill:
    CommandLine|contains:
      - 'taskkill /F /IM'
      - 'Stop-Process -Force'
  selection_target:
    CommandLine|contains:
      - 'MsMpEng.exe'
      - 'csagent.exe'
      - 'sophosui.exe'
      - 'edragent.exe'
      - 'wrsa.exe'
  condition: all of selection_*
falsepositives:
  - Administrators manually troubleshooting security software
level: high

// Hunt for msimg32.dll loading outside System32 context
DeviceImageLoadEvents
| where FileName =~ "msimg32.dll"
| where FolderPath !startswith @"C:\Windows\System32\"
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessCommandLine, SHA256, FolderPath
| join kind=inner (DeviceProcessEvents) on $left.InitiatingProcessCommandLine == $right.CommandLine
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, ImagePath, DllPath=FolderPath, DllHash=SHA256

-- Hunt for suspicious msimg32.dll files on disk
SELECT FullPath, Size, Mtime, Atime
FROM glob(globs="C:\Users\**\msimg32.dll")
WHERE FullPath NOT =~ "C:\\Windows\\System32\\msimg32.dll"

-- Enumerate loaded drivers looking for common BYOVD targets
SELECT Name, Description, Company, Filename
FROM drivers()
WHERE Filename =~ "RTCore64.sys"
   OR Filename =~ "dbutil_2_3.sys"
   OR Filename =~ "capcom.sys"
   OR Filename =~ "mhyprot2.sys"

# Security Arsenal - Qilin/Warlock BYOVD Response Script

Write-Host "[*] Initiating sweep for msimg32.dll artifacts..." -ForegroundColor Cyan

# Hunt for msimg32.dll outside System32
$paths = @("C:\Users\", "C:\ProgramData\", "C:\Windows\Temp\")
$artifacts = foreach ($path in $paths) {
    Get-ChildItem -Path $path -Filter "msimg32.dll" -Recurse -ErrorAction SilentlyContinue | 
    Where-Object { $_.FullName -notlike "*Windows\System32*" }
}

if ($artifacts) {
    Write-Host "[!] ALERT: Malicious msimg32.dll found!" -ForegroundColor Red
    $artifacts | Format-List FullName, Length, LastWriteTime
    # Optional: Remove-Item $_.FullName -Force (Manual verification required)
} else {
    Write-Host "[+] No suspicious msimg32.dll found in user directories." -ForegroundColor Green
}

# Check HVCI Status (Defends against BYOVD)
Write-Host "[*] Checking Hypervisor-Protected Code Integrity (HVCI) status..." -ForegroundColor Cyan
try {
    $ci = Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard
    $vbsEnabled = $ci.SecurityServicesConfigured -band 1
    $hvciEnabled = $ci.SecurityServicesConfigured -band 2
    
    if ($hvciEnabled) {
        Write-Host "[+] HVCI is ENABLED (Memory Integrity is ON)." -ForegroundColor Green
        Write-Host "    This is the strongest defense against BYOVD attacks." -ForegroundColor Gray
    } else {
        Write-Host "[!] WARNING: HVCI is DISABLED. Your environment is vulnerable to BYOVD." -ForegroundColor Red
        Write-Host "    Action Required: Enable Memory Integrity in Windows Security Center." -ForegroundColor Yellow
    }
} catch {
    Write-Host "[!] Could not determine Device Guard status." -ForegroundColor Yellow
}

Write-Host "[*] Response Script Complete." -ForegroundColor Cyan