The Gentlemen Ransomware — TukTuk C2 v2.0 & GentleKiller BYOVD EDR Neutralization: OTX Detection Pack

---
title: The Gentlemen BYOVD EDR Killer Driver Load
id: 9f1c2a34-7b5d-4e6a-9c01-2d4e5f6a7b8c
status: experimental
description: Detects kernel driver loads associated with The Gentlemen ransomware EDR-neutralization tooling (GentleKiller eb.sys) via known IOC hashes and driver filename. Kernel payloads bypass user-mode EDR hooks, making driver_load telemetry the primary detection surface.
author: Security Arsenal Threat Intelligence
date: 2026/09/04
modified: 2026/09/04
references:
    - https://oasis-security.io/blog/The-Gentlemen-Ransomware-Hacker-Groups-TukTuk-Framework
logsource:
    product: windows
    category: driver_load
detection:
    selection_name:
        ImageLoaded|endswith:
            - '\eb.sys'
    selection_hash:
        Hashes|contains:
            - '97BD65E98CDC4E93D49EDD4EA905D43A61244DF0FD3323E6649330DE3B1BE091'
            - 'E2B31AC7EE077B26332444A83A68AB75BE641113E7D86979D844A0F3478F01F9'
            - 'E74088419DE2E5B47B1889F2BA1369CB4B436405CE03CF07DA452791681F9923'
            - '096EC37870EB401793592C9B53B5B52FC7A70B113BC2D9CD3F53231142D6C584'
    condition: 1 of selection_*
falsepositives:
    - Unknown. eb.sys is not a standard Microsoft driver name.
level: critical
tags:
    - attack.defense_evasion
    - attack.t1562.001
    - attack.t1068
---
title: EDR Killer Kernel Driver Service Creation
id: 3a7b9d12-4c5e-4f8a-b2d3-6e7f8a9b0c1d
status: experimental
description: Detects creation of a Windows service pointing at a .sys kernel driver, the delivery mechanism used to stage GentleKiller/EDRKiller/WarsawKiller BYOVD payloads before EDR neutralization and ransomware execution.
author: Security Arsenal Threat Intelligence
date: 2026/09/04
modified: 2026/09/04
logsource:
    product: windows
    category: process_creation
detection:
    selection_sc:
        Image|endswith: '\sc.exe'
        CommandLine|contains|all:
            - 'create'
            - 'binPath'
    selection_driver:
        CommandLine|contains:
            - '.sys'
            - 'type= kernel'
    condition: all of selection_*
falsepositives:
    - Legitimate software or hardware driver installations. Baseline against software deployment tooling and alert on non-standard parent processes.
level: high
tags:
    - attack.persistence
    - attack.t1543.003
    - attack.defense_evasion
    - attack.t1562.001
---
title: TukTuk C2 Framework DNS Resolution
id: 5c2e8f41-9a3b-4d6c-8e1f-7a2b3c4d5e6f
status: experimental
description: Detects DNS resolution of TukTuk C2 framework infrastructure associated with The Gentlemen ransomware operation. Any hit warrants immediate host isolation and memory acquisition.
author: Security Arsenal Threat Intelligence
date: 2026/09/04
modified: 2026/09/04
logsource:
    category: dns
detection:
    selection:
        QueryName|contains:
            - 'borjumaniya.store'
    condition: selection
falsepositives:
    - Security researcher or sandbox traffic pivoting on published indicators.
level: critical
tags:
    - attack.command_and_control
    - attack.t1071.001
    - attack.t1568

// The Gentlemen / TukTuk C2 — unified indicator + behavior hunt
let TukTukHashes = dynamic(["4e5136230ec590ce6ef038aac6e72cb2","ba914fe77b177b45799403b16dd14765c510a074","97bd65e98cdc4e93d49edd4ea905d43a61244df0fd3323e6649330de3b1be091","138c41085f5f07adbdeff4df97a6a80252571e28","e2b31ac7ee077b26332444a83a68ab75be641113e7d86979d844a0f3478f01f9","e74088419de2e5b47b1889f2ba1369cb4b436405ce03cf07da452791681f9923","096ec37870eb401793592c9b53b5b52fc7a70b113bc2d9cd3f53231142d6c584"]);
union isfuzzy=true
(DeviceNetworkEvents
| where RemoteUrl has "borjumaniya.store"
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessId, RemoteUrl, RemoteIP, RemotePort, ActionType),
(DeviceProcessEvents
| where ProcessCommandLine has_any ("eb.sys", "gentlekiller", "warsawkiller", "tuktuk")
   or (ProcessCommandLine has_all ("sc.exe", "create", "binPath") and ProcessCommandLine has ".sys")
   or (FileName =~ "bcdedit.exe" and ProcessCommandLine has_any ("testsigning", "nointegritychecks"))
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, AccountName, InitiatingProcessFileName),
(DeviceFileEvents
| where SHA256 in~ (TukTukHashes) or SHA1 in~ (TukTukHashes) or MD5 in~ (TukTukHashes)
   or FileName =~ "eb.sys"
| project TimeGenerated, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName),
(DeviceEvents
| where ActionType == "DriverLoad" or AdditionalFields has "eb.sys"
| where AdditionalFields has_any ("eb.sys", "\\Temp\\", "\\ProgramData\\")
| project TimeGenerated, DeviceName, ActionType, FileName, FolderPath, AdditionalFields)
| order by TimeGenerated desc

# The Gentlemen / TukTuk C2 — endpoint IOC & tamper hunt
$ErrorActionPreference = 'SilentlyContinue'
Write-Host "[*] The Gentlemen / TukTuk C2 Host Hunt" -ForegroundColor Cyan

# 1. IOC hash sweep of common staging paths
$iocs = @(
  '4e5136230ec590ce6ef038aac6e72cb2',
  'ba914fe77b177b45799403b16dd14765c510a074',
  '97bd65e98cdc4e93d49edd4ea905d43a61244df0fd3323e6649330de3b1be091',
  '138c41085f5f07adbdeff4df97a6a80252571e28',
  'e2b31ac7ee077b26332444a83a68ab75be641113e7d86979d844a0f3478f01f9',
  'e74088419de2e5b47b1889f2ba1369cb4b436405ce03cf07da452791681f9923',
  '096ec37870eb401793592c9b53b5b52fc7a70b113bc2d9cd3f53231142d6c584'
)
Write-Host "`n[1] Sweeping staging paths for IOC hashes..."
$paths = @("$env:TEMP", "$env:ProgramData", "C:\Windows\Temp", "C:\Users\Public")
foreach ($p in $paths) {
  Get-ChildItem -Path $p -Recurse -File | ForEach-Object {
    $h = (Get-FileHash -Algorithm SHA256 -Path $_.FullName).Hash.ToLower()
    if ($iocs -contains $h) { Write-Host "[!] HASH MATCH: $($_.FullName)" -ForegroundColor Red }
  }
}

# 2. Loaded killer drivers (GentleKiller eb.sys / BYOVD)
Write-Host "`n[2] Checking loaded drivers for killer tooling..."
Get-CimInstance Win32_SystemDriver | Where-Object { $_.PathName -match 'eb\.sys|gentle|warsaw|tuktuk' } |
  ForEach-Object { Write-Host "[!] SUSPICIOUS DRIVER: $($_.Name) -> $($_.PathName)" -ForegroundColor Red }

# 3. Registered kernel services pointing at malicious .sys files
Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Services\*' |
  Where-Object { $_.ImagePath -match 'eb\.sys|gentle|warsaw|tuktuk' } |
  ForEach-Object { Write-Host "[!] SUSPICIOUS SERVICE: $($_.PSChildName) -> $($_.ImagePath)" -ForegroundColor Red }

# 4. TukTuk C2 beacons
Write-Host "`n[3] Checking DNS cache and live sessions for C2..."
Get-DnsClientCache | Where-Object { $_.Entry -match 'borjumaniya\.store' } | Format-Table
Get-NetTCPConnection -State Established | ForEach-Object {
  $r = Resolve-DnsName $_.RemoteAddress
  if ($r.NameHost -match 'borjumaniya') {
    Write-Host "[!] LIVE C2 SESSION: $($_.RemoteAddress):$($_.RemotePort) PID $($_.OwningProcess)" -ForegroundColor Red
  }
}

# 5. EDR tampering artifacts left behind by killer tooling
Write-Host "`n[4] Checking Defender tampering state..."
$pref = Get-MpPreference
if ($pref.DisableRealtimeMonitoring) { Write-Host "[!] Real-time protection DISABLED" -ForegroundColor Red }
$pref.ExclusionPath | ForEach-Object { Write-Host "[!] Suspicious exclusion: $_" -ForegroundColor Yellow }
Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender' |
  Where-Object { $_.DisableAntiSpyware -eq 1 } |
  ForEach-Object { Write-Host "[!] Defender disabled via policy" -ForegroundColor Red }
Write-Host "`n[*] Hunt complete."