EDR Killers Explained: How Attackers Deliberately Disable Endpoint Protection

Ransomware groups hold an uncomfortable truth for security leaders: instead of developing ever more sophisticated malware, they simply switch off the endpoint protection. So-called EDR killers have become a standard component of modern attack chains. A recent ESET analysis of roughly 90 actively deployed EDR killers shows how professional and diverse this ecosystem has become, and why organizations that rely exclusively on Endpoint Detection & Response have a dangerous blind spot.

What are EDR killers and why do they work?

The logic behind EDR killers is strikingly simple: rather than packaging malware so that it slips past endpoint detection, attackers disable the protection mechanism before the actual attack. The principle: "First kill the guard, then encrypt."

For ransomware operators, this approach is attractive for several reasons. The encryptor stays stable and does not need constant adjustment. Reliability increases because a predictable window for encryption emerges. And publicly available proof-of-concepts lower the barrier to entry so far that even less technically skilled affiliates can deploy these tools.

The five categories of modern EDR killers

The EDR killer landscape is far more diverse than the public discussion, which is often reduced to vulnerable drivers, would suggest. Based on current research, five main categories can be identified.

1. Script-based approaches

The simplest variant uses Windows built-ins such as taskkill, net stop or sc delete to terminate security processes and services. Some variants force a reboot into Safe Mode, where EDR agents are not loaded. These methods are noisy, generate plenty of telemetry and are typically associated with less skilled actors. They are nevertheless still encountered in practice.

2. Abuse of anti-rootkit tools

Legitimate administration and remediation tools such as GMER, PC Hunter or HRSword require kernel access by nature. Attackers repurpose these utilities to terminate EDR processes with elevated privileges. The gray area between legitimate use and abuse makes detection particularly challenging.

3. Bring Your Own Vulnerable Driver (BYOVD)

Accounting for roughly 60% of the analyzed tools, BYOVD is the dominant approach. Attackers bring along a legitimate but vulnerable driver, install it with elevated privileges and exploit the vulnerability through the DeviceIoControl API to terminate security processes or disable kernel callbacks. At least 35 different vulnerable drivers are documented, including components from Baidu Antivirus, Avast, K7 Computing and various hardware utilities.

Particularly problematic: the same drivers appear in completely unrelated tools, and individual tools switch between different drivers. This makes attribution based on driver analysis alone unreliable.

4. Rootkits

Rarer, but particularly dangerous: kernel-mode rootkits such as ABYSSWORKER operate with stolen code-signing certificates and thereby bypass the driver signing requirements of Windows. Certificate revocation alone is not a sufficient countermeasure, as the chain of trust is already compromised.

5. Driverless EDR killers

A growing segment avoids kernel interaction entirely. Tools such as EDRSilencer block the communication between endpoint agent and backend infrastructure, while EDR-Freeze puts EDR processes into a non-responsive state. These unconventional approaches make detection considerably harder and are adopted within days of a proof-of-concept being published.

The business model: from DIY to Killer-as-a-Service

The development of EDR killers follows three models that reflect the level of professionalization in the ransomware ecosystem.

In-house development: Groups such as Embargo or Warlock build their own tools, some with impressive technical depth. The Warlock group, for example, deploys up to nine different drivers per intrusion, including some without publicly available exploits. There are also indications of AI-assisted code generation, recognizable by generic boilerplate patterns and trial-and-error mechanisms in the code.

PoC modification: The most common model. Attackers take public proof-of-concepts, change debug messages, add obfuscation, adjust the target list of security products or port the code to another programming language. The actual exploit logic remains practically unchanged. The BlackSnufkin BYOVD repository in particular serves as the most widely used codebase for ransomware affiliates.

Commercial offerings: EDR killers are now sold as a service. Offerings such as DemoKiller, AbyssKiller or CardSpaceKiller provide professional features: anti-VM detection, continuous repacking, encrypted payloads and structured customer support. Prices range from hundreds to thousands of US dollars. Customers are affiliates of well-known ransomware groups such as Qilin, Akira, Medusa and DragonForce.

Why driver blocking alone is not enough

The obvious defensive strategy, blocking known vulnerable drivers, is necessary but far from sufficient. In February 2025 alone, over 2,500 variants of the Truesight.sys driver with valid signatures were identified. Expired or revoked certificates still bypass the checks in some cases. And driverless EDR killers undercut this line of defense entirely.

On top of that, blocking legitimate drivers carries the risk of operational disruptions, since the same drivers may be used in production environments for hardware management or other purposes.

The blind spot: what happens when EDR goes down?

This is where the fundamental problem of a purely endpoint-centric security architecture becomes apparent: once the EDR agent is successfully disabled, the Security Operations Center loses all visibility on the affected endpoint. Lateral movement, data exfiltration and the final encryption then happen in the dark.

This is exactly where Network Detection & Response (NDR) becomes the critical complementary layer of protection. NDR operates independently of the endpoint and monitors network traffic at the protocol level. A disabled EDR agent changes nothing about the fact that:

• arrow_rightLateral movement stays visible - Unusual SMB, RDP or WMI connections between hosts are detected at the network level, regardless of whether the endpoint agent is active.
• arrow_rightC2 communication is detected - The traffic between a compromised endpoint and the command-and-control server traverses the network and is identified through behavioral analysis and threat intelligence.
• arrow_rightData exfiltration stands out - Large volumes of data leaving the network toward the internet create network anomalies that NDR reliably detects.
• arrow_rightThe EDR outage itself is a signal - When a previously active endpoint suddenly stops delivering telemetry, that is a high-priority alert from an NDR perspective.

Recommendations for CISOs and IT security leaders

Given the increasing professionalization of EDR killers, organizations in the DACH region should critically review their defense strategy. The following measures are central:

Implement defense-in-depth consistently: EDR remains an important component but must not be the only detection layer. Combining it with NDR creates a second, independent line of sight that holds even when endpoints are compromised.

Actively block vulnerable drivers: The Microsoft Vulnerable Driver Blocklist and custom policies via WDAC (Windows Defender Application Control) should be applied consistently, in the knowledge that this alone is not enough.

Monitor EDR agent integrity: Enable tamper protection features and treat the sudden loss of endpoint telemetry as a highly critical event.

Tighten network segmentation: The more granular the segmentation, the smaller the blast radius when an endpoint is compromised. NDR delivers the visibility to detect segmentation violations in real time.

Adapt incident response plans: Scenarios in which EDR is unavailable must be covered in tabletop exercises and playbooks. Network-based forensics then becomes the primary source of information.

Conclusion: watching only the endpoint is not enough

EDR killers are not a fringe phenomenon: they are a systematic, commercialized component of modern ransomware operations. The analysis shows that the ecosystem ranges from simple scripts all the way to professional Killer-as-a-Service offerings. For security leaders this means: a purely endpoint-centric defense is no longer sufficient. Network Detection & Response closes the gap that opens when EDR goes down, and delivers the network visibility that attackers cannot switch off.