The Gentlemen RaaS Evolution: Dissecting the GentleKiller EDR Evasion Tech
Just caught the latest intel on The Gentlemen RaaS operation. It looks like they've moved past simple batch scripts and are now actively maintaining a full-blown EDR evasion framework called 'GentleKiller'.
According to the report, this framework targets nearly 400 security processes. That is massive coverage. It suggests they aren't just targeting Microsoft Defender; they are going after CrowdStrike, SentinelOne, and every other major vendor. The maturity of this RaaS is concerning because providing a dedicated toolkit for defense evasion significantly lowers the barrier to entry for affiliates who don't have their own zero-days.
Technically, we need to be looking for unauthorized service stops or specific driver loading sequences. Most of these kill-switches rely on either direct system calls or BYOVD (Bring Your Own Vulnerable Driver) attacks to load a kernel driver that obliterates the EDR's callback routines.
If you are using Microsoft Sentinel, here is a query to help detect mass termination patterns:
DeviceProcessEvents
| where ActionType == "ProcessTerminated"
| where ProcessVersionInfoInternalFileName in~ ("MsMpEng", "WinDefend", "CBService", "FalconService", "CyveraService")
| summarize dcount(TargetProcessFileName) by DeviceName, InitiatingProcessAccountName, bin(Timestamp, 5m)
| where dcount_TargetProcessFileName > 2
This doesn't catch driver-based attacks, but it flags the script-based kills effectively.
How is everyone handling the BYOVD vector these days? Are you blocking vulnerable drivers via ASR rules or using specific tools like LOLDrivér to scan your endpoints?
We’ve actually been hunting for this behavior for a few weeks. The key indicator we found isn't just the termination, but the timing. The EDR usually crashes roughly 2 minutes before the SMB enumeration starts. We added a correlation rule in our SIEM to watch for 'EDR Service Stopped' followed by 'New Service Created' within a 5-minute window. It has drastically reduced our dwell time detection.
Good write-up. We've started leveraging ELAM (Early Launch Anti-Malware) drivers specifically to protect the EDR processes themselves. It's a bit of a headache to manage in a heterogeneous environment, but it stops the drivers that GentleKiller relies on from loading even before the main EDR starts.
Verified Access Required
To maintain the integrity of our intelligence feeds, only verified partners and security professionals can post replies.
Request Access