Attackers exploit old Windows vulnerability to disable EDR

In a recent incident, attackers exploited a legitimate but vulnerable Windows kernel driver to disable endpoint security tools during an ongoing incident response. According to a Huntress report, the activity was observed during a customer investigation in early 2026 and involved the use of an old EnCase (from Guidance Software) as part of a Bring Your Own Vulnerable Driver (BYOVD) technique to terminate Endpoint Detection and Response (EDR) processes from kernel mode.

See also: Microsoft will add Sysmon natively to Windows 11

The attack began with compromised SonicWall SSL VPN, after which the attacker performed internal reconnaissance and deployed a custom “EDR killer” binary. “The attack was stopped before the ransomware was deployed, but the case highlights a growing trend: threat actors are weaponizing signed, legitimate drivers to circumvent endpoint security,” Huntress researchers said in a blog post.

According to the researchers, the attack used a common technique of abusing a legitimately signed driver that already has kernel-level privileges. This gave the attackers direct, high-level access to the kernel, effectively allowing them to terminate almost any process they want, including security tools. Windows Driver Signing Enforcement, the policy that requires all kernel-mode drivers to be digitally signed by a trusted Certificate Authority (CA), does not check certificate revocation lists when the kernel loads.

The researchers noted that this is legacy behavior that remains exploitable due to compatibility features introduced years ago that allow an exception for drivers signed with certificates issued before July 29, 2015 and associated with a supported cross-signed CA. The EnCase driver contains a timestamp from a VeriSign service, which the authentication still considers valid.

See also: Microsoft disables NTLM protocol in Windows

Once in the kernel, the driver exposes an IOCTL interface that allows the malware to terminate arbitrary processes with full system privileges. Among the functions exposed are process termination commands that bypass user-level protections for Protected Process Light (PPL), the defenses that EDR systems rely on to avoid tampering.

The EDR killer binary used in the attack observed by Huntress contained a 64-bit Windows executable and a custom coded kernel driver payload, which it decoded into OemHwUpd.sys and installed as a kernel mode service. Because Windows still honors its cryptographic signature, the attackers were able to load the driver.

Once the vulnerable driver was in place, the EDR killer compiled an internal list of 59 known security tool processes, hashing their names and continuously checking for their presence on the system.

Huntress recommended enabling Microsoft's Vulnerable Driver Block List on all supported Windows systems to prevent known abusive drivers from loading.

See also: Windows 11 boot failures: Linked to the December update

The researchers also advised enforcing strong access controls on remote access services, including MFA for VPNs such as SonicWall, and closely monitoring for suspicious driver installation activity. Where possible, organizations are also encouraged to enable virtualization-based security features such as Hypervisor-protected Code Integrity (HVCI) to further mitigate kernel mode abuse.