A tool previously tied to ransomware intrusions is now being observed in attacks that disable or terminate endpoint detection and response products before the main payload is launched, according to a new report. The activity underscores a familiar pattern in modern ransomware operations: attackers first try to blind defenders, then move quickly to encrypt systems, steal data, or expand access.
The technique focuses on weakening security controls at the endpoint level, where EDR agents monitor processes, drivers, file activity, and suspicious behavior. By stopping those protections or interfering with their components, threat actors can reduce the chance that later-stage malware, credential theft, lateral movement, or ransomware deployment will be blocked or investigated in time.
As an Amazon Associate I earn from qualifying purchases.
For security teams, the report is a reminder that EDR resilience is now part of the attack surface. Detecting tampering attempts, limiting administrative abuse, monitoring vulnerable driver activity, and hardening endpoint agents against unauthorized shutdown are becoming essential defenses against ransomware crews that increasingly prioritize killing security tools before launching the visible phase of an attack.
What the Report Found
The report describes a tool previously associated with ransomware intrusion sets being used as a pre-encryption utility to shut down endpoint detection and response agents. Rather than acting as the ransomware payload itself, the tool is deployed during the hands-on-keyboard phase of an intrusion, after attackers have gained administrative access and before they begin broader actions such as credential theft, lateral movement, data staging, or file encryption.
Researchers found that the tool targets defensive processes, services, drivers, and kernel-level components that many EDR products rely on to inspect behavior and block malicious activity. In observed cases, attackers used it to create a quieter operating environment on compromised Windows hosts, reducing the chance that follow-on tools would be stopped or that alerts would reach the security operations team in time. The activity fits a pattern increasingly seen in ransomware operations: adversaries first weaken monitoring, then move quickly to expand access and maximize impact.
The report links the tool to the broader category of “EDR killer” utilities, which are designed to interfere with security software rather than exploit a business application directly. Some variants abuse legitimate, signed drivers that contain vulnerable functionality. By loading or interacting with those drivers, an attacker with sufficient privileges can perform actions that normal user-mode malware could not, including terminating protected processes or tampering with security controls that are otherwise resistant to standard administrative commands.
According to the findings, the tool’s use is not limited to one ransomware brand or one intrusion cluster. It appears to have circulated among mulle financially motivated operators, either through private sharing, affiliate programs, or criminal marketplaces. That distribution model makes the threat more difficult to track because the same disabling capability can appear in incidents with different ransomware payloads, different initial access methods, and different extortion names.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errors- Primary purpose: disable, degrade, or terminate EDR and antivirus components before later attack stages.
- Typical timing: after privilege escalation and before ransomware deployment or large-scale lateral movement.
- Common prerequisite: administrative or SYSTEM-level access on the targeted endpoint.
- Operational value: fewer blocked tools, fewer real-time alerts, and a larger window for attacker activity.
The report also emphasizes that the presence of such a utility should be treated as a high-severity intrusion signal, not an isolated malware event. If an attacker is attempting to kill EDR, they likely already have meaningful access and may be preparing for disruptive actions. For defenders, that means investigation should extend beyond the host where the tool was found to include recent logons, remote execution activity, domain administration events, file share access, and any signs of data collection or exfiltration staging.
How the Tool Disables EDR Protections
The reported technique centers on abusing legitimate, trusted Windows components to interfere with endpoint detection and response software at the point where it has the most visibility: its local sensor, service, driver, or process. Rather than relying only on obvious process termination commands, the tool is designed to weaken protections in stages so the attacker can run follow-on payloads with less chance of interception. This commonly happens after the intruder has already obtained administrative privileges on the host, because stopping security services, unloading drivers, or changing protected settings usually requires elevated access.
One common approach is known as bring-your-own-vulnerable-driver, or BYOVD. In this pattern, the attacker drops and loads a legitimately signed but vulnerable kernel driver. Because the driver carries a valid signature, it may be trusted by the operating system or by security controls that do not enforce a strict vulnerable-driver blocklist. Once loaded, the driver can be abused to perform privileged actions from kernel space, including terminating protected EDR processes, tampering with callbacks, disabling telemetry collection, or blocking the security product’s ability to inspect malicious activity. This gives the attacker a way around normal user-mode defenses that would otherwise resist simple kill commands.
The tool may also attempt to stop or degrade EDR components through service control, registry changes, driver manipulation, file permission changes, or direct process interference. Some variants enumerate running processes and services, compare them against a built-in list of security vendor names, and then target matching items. Others attempt to remove hooks, suspend monitoring processes, delete quarantine or logging artifacts, or prevent sensors from restarting after a reboot. In many cases, the objective is not to fully uninstall the product; it is enough to create a short window where credential theft, lateral movement, data staging, encryption, or destructive commands can proceed with reduced scrutiny.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Rank #2
- 𝐇𝐢𝐠𝐡 𝐒𝐞𝐧𝐬𝐢𝐭𝐢𝐯𝐢𝐭𝐲 𝐃𝐞𝐭𝐞𝐜𝐭𝐢𝐨𝐧: JKUSS handheld metal detector offers high sensitivity to quickly detect small hidden metals like nails, screws, weapons, and jewelry. Ideal for security screening, woodworking, or event safety, this security wand scanner helps prevent damage and improves inspection efficiency
- 𝟑 𝐀𝐥𝐞𝐫𝐭 𝐌𝐨𝐝𝐞𝐬 𝐟𝐨𝐫 𝐀𝐧𝐲 𝐄𝐧𝐯𝐢𝐫𝐨𝐧𝐦𝐞𝐧𝐭: Choose from Sound, Vibration, or Combined modes depending on your surroundings. Whether you're working in noisy areas or need silent operation, this metal detector wand adapts for clear and reliable alerts
- 𝐀𝐝𝐣𝐮𝐬𝐭𝐚𝐛𝐥𝐞 𝐒𝐞𝐧𝐬𝐢𝐭𝐢𝐯𝐢𝐭𝐲 𝐟𝐨𝐫 𝐏𝐫𝐞𝐜𝐢𝐬𝐞 𝐒𝐜𝐚𝐧𝐧𝐢𝐧𝐠: Adjustable sensitivity feature allows you to tailor the detector’s response.Easily switch to low sensitivity mode during scanning to ignore small objects like keys and coins, focusing on larger threats such as knives or handguns. This allows for more accurate and efficient inspections in high-traffic areas
- 𝐑𝐞𝐜𝐡𝐚𝐫𝐠𝐞𝐚𝐛𝐥𝐞 𝐁𝐚𝐭𝐭𝐞𝐫𝐲 𝐰𝐢𝐭𝐡 𝐔𝐒𝐁 𝐂𝐡𝐚𝐫𝐠𝐢𝐧𝐠:Powered by a built-in 2000mAh rechargeable battery, this metal detector wand includes a USB charging cable—no need to buy disposable batteries. Fully charges in 2–3 hours and offers long-lasting operation with no downtime
- 𝐏𝐨𝐫𝐭𝐚𝐛𝐥𝐞 & 𝐕𝐞𝐫𝐬𝐚𝐭𝐢𝐥𝐞 𝐔𝐬𝐞:Lightweight and easy to handle, the JKUSS metal detector is ideal for both indoor and outdoor use at airports, schools, stadiums, checkpoints, construction sites, and more. Perfect for security officers, woodworkers, and event staff
- Process targeting: Identifies EDR and antivirus executables, then terminates or suspends them.
- Service disruption: Stops sensor services, changes startup settings, or blocks restart attempts.
- Kernel driver abuse: Loads a vulnerable signed driver to gain privileged control over protected processes.
- Telemetry interference: Disrupts event collection, file scanning, behavioral monitoring, or network inspection.
- Persistence changes: Alters local configuration so protections remain weakened after reboot.
This activity can affect environments where endpoint agents run with insufficient tamper protection, where vulnerable driver blocking is not enforced, or where administrative credentials are widely available to attackers after initial compromise. Defenders using modern EDR platforms are still exposed if the attacker can execute privileged code locally and the platform’s self-protection controls are misconfigured, outdated, or dependent on components the tool can disable. The risk is higher on unmanaged servers, older Windows builds, systems excluded from policy enforcement, and hosts where security tools are not consistently updated.
Security teams should treat attempted EDR shutdown as a high-confidence precursor to ransomware deployment. Useful signals include unexpected driver loads, especially signed drivers with poor reputation; service stop commands aimed at security tools; sudden loss of endpoint telemetry; security processes terminating without an approved maintenance window; and command-line activity involving sc.exe, taskkill, PowerShell, WMI, or vendor-specific service names. Correlating these events with recent privilege escalation, remote execution, credential dumping, or lateral movement can help responders contain the host before encryption or data theft accelerates.
Why Ransomware Groups Use EDR Killers
Ransomware operators use EDR-killing tools because modern intrusions are usually stopped during the final stages, not the initial access stage. Once an attacker has obtained credentials, moved laterally, and identified file servers or backup systems, endpoint detection and response agents become one of the last barriers between preparation and encryption. Disabling those agents gives the attacker a cleaner window to dump credentials, delete backups, stage payloads, and launch ransomware across many hosts with fewer alerts and fewer automated blocks.
The tactic is especially valuable because EDR products are designed to watch the exact behaviors ransomware crews rely on: suspicious PowerShell or command-line execution, credential access, driver loading, process injection, mass file modification, shadow copy deletion, and remote service creation. If the attacker can terminate the sensor, blind its telemetry, or prevent its service from restarting, the rest of the operation can proceed with less interference. In many cases, the goal is not stealth for days; it is a short period of reduced visibility during which encryption and extortion activity can complete.
Operational advantages for ransomware crews
- Fewer blocked payloads: EDR agents often quarantine ransomware binaries, stop suspicious scripts, or kill processes that begin rapid file encryption. Removing the agent increases the chance that the payload runs successfully.
- Reduced analyst visibility: Security teams depend on endpoint telemetry to reconstruct lateral movement, privilege escalation, and execution paths. Killing the agent can create gaps in timelines and make containment slower.
- More reliable lateral movement: Attackers commonly use remote management tools, PsExec-like execution, WMI, scheduled tasks, or stolen admin credentials. EDR controls frequently flag these patterns when they appear at scale.
- Protection for tooling: Credential dumpers, network scanners, tunneling utilities, and data exfiltration tools are more likely to survive when endpoint protections are weakened before deployment.
- Pressure on incident response: If dozens or hundreds of machines suddenly go dark, responders must distinguish sensor failure from active compromise while the ransomware crew accelerates its attack.
EDR killers also fit the economics of ransomware. Many groups operate as affiliates that reuse playbooks, scripts, and purchased tools across victims. A working EDR-disabling method can be packaged into the intrusion workflow and executed before encryption with minimal customization. This lowers the skill required for affiliates and increases the odds of a successful payout, particularly against organizations where endpoint tools are deployed widely but not hardened against tampering.
The use of these tools also reflects a shift from simple malware execution to deliberate security control neutralization. Attackers increasingly test their payloads against commercial products, identify weak driver configurations or exposed management functions, and build routines that stop services, unload components, or abuse vulnerable signed drivers. For defenders, the presence of an EDR killer should be treated as a late-stage attack signal: the adversary may already have elevated privileges, domain reach, and a prepared ransomware deployment path.
Affected Security Products and Environments
The report describes an EDR-killing tool built to interfere with mulle endpoint security agents rather than a single vendor product. Its target list includes well-known enterprise security platforms commonly deployed across Windows fleets, especially tools that rely on protected services, kernel drivers, user-mode sensor processes, and cloud-managed policy enforcement. In practice, the highest exposure is in Windows environments where attackers have already obtained administrative privileges and can introduce a vulnerable driver or abuse existing driver-loading pathways.
Affected defenders are typically organizations running endpoint detection and response, extended detection and response, antivirus, or managed detection agents on servers and workstations that permit local administrator activity without strong driver controls. The tool is not described as bypassing every protection by default; instead, it attempts to stop, blind, or destabilize security components through a sequence of product-specific checks and termination routines. Products with tamper protection, self-defense drivers, and protected service configurations can still be targeted if those controls are misconfigured, disabled during troubleshooting, inconsistently enforced, or undermined by a vulnerable signed driver.
Environments most exposed
- Windows domain environments where threat actors can move laterally using stolen administrator credentials and execute tools remotely through PsExec, WMI, scheduled tasks, or remote management frameworks.
- Servers with broad operational privileges, including file servers, backup servers, virtualization hosts, and management jump boxes, because disabling security on these systems can accelerate ransomware deployment.
- Endpoints without strict driver allowlisting, where a signed but vulnerable driver can be loaded to gain low-level access and interfere with security processes.
- Mixed security estates where different business units run different EDR or antivirus products, creating inconsistent tamper-protection coverage and uneven alerting.
- Partially managed assets such as legacy Windows systems, lab machines, acquisition networks, or remote offices that may not receive the same policy enforcement as core corporate endpoints.
The report’s findings should not be read as a flaw in one security vendor alone. The broader issue is the technique: bring a trusted or signed component into the environment, obtain sufficient privileges, then use that position to interfere with defensive tooling before ransomware encryption, data theft, or destructive actions begin. Security products that expose local control interfaces, depend on killable user-mode processes, or lack hardened self-protection can be more vulnerable to disruption, but even mature platforms can lose visibility if attackers gain kernel-level leverage.
Cloud-managed EDR deployments may also be affected indirectly. If the local sensor is stopped, unloaded, isolated from the network, or prevented from collecting telemetry, the management console may show stale data, delayed check-ins, or sudden gaps in event volume rather than a clean high-confidence alert. Security teams should therefore treat abrupt silence from a previously active endpoint as suspicious, especially when it occurs on mulle hosts in the same administrative scope or shortly after privileged logons, remote service creation, or driver installation events.
Detection Clues and Attack Chain Indicators
EDR-killing activity often appears shortly before ransomware deployment, data theft, or lateral movement at scale. Security teams should treat sudden gaps in endpoint telemetry as an active intrusion signal, not merely an agent health issue. Affected hosts may stop reporting process events, file activity, network connections, or command-line data while remaining reachable over SMB, RDP, WinRM, or remote management tooling. That mismatch can be one of the clearest early indicators that defenses are being tampered with.
Common host-level clues include unexpected driver loading, attempts to interact with kernel services, changes to security product services, and process termination attempts against agent components. Many EDR-killer tools rely on bringing a vulnerable signed driver onto the system, then abusing its privileges to kill protected security processes from kernel mode. Telemetry to review includes Windows service control events, driver installation records, new files written to temporary or staging directories, and command lines referencing security vendor process names.
High-signal events to hunt for
- New or unusual drivers: recently created .sys files, driver services created through sc.exe, PowerShell, WMI, or custom loaders, especially from user-writable paths.
- Security service disruption: stopped, disabled, deleted, or repeatedly restarted EDR, antivirus, logging, backup, or vulnerability management services.
- Protected process termination: failed and successful attempts to kill processes belonging to endpoint agents, sensors, update services, or local management components.
- Telemetry silence: endpoints that stop sending security logs while domain controller, VPN, firewall, or EDR console records show continued authentication or network activity.
- Pre-ransomware staging: archive tools, credential dumpers, remote execution utilities, data transfer clients, and ransomware binaries appearing soon after defense tampering.
Attack chain indicators frequently start before the EDR killer is executed. Initial access may come through exposed remote access services, stolen VPN credentials, phishing, exploitation of edge devices, or compromised managed service provider tooling. Once inside, operators commonly enumerate the environment, identify security products, test privilege levels, and move laterally to high-value servers. Queries for installed software, running services, domain trust relationships, backup infrastructure, and administrative shares can help connect earlier reconnaissance to later endpoint protection shutdown attempts.
Network defenders should correlate endpoint gaps with authentication and remote execution data. Look for bursts of logons using the same privileged account across many systems, remote service creation, PsExec-like behavior, WMI process creation, scheduled tasks, and SMB file copies into administrative shares. If mulle endpoints stop reporting within a narrow time window, especially after a privileged account logs in from an unusual workstation or server, the pattern should trigger incident response procedures. Firewall and proxy logs may also show downloads of driver files, compressed toolkits, or command-and-control traffic shortly before security tools are disabled.
Useful log sources
| Source | What to review |
|---|---|
| Windows event logs | Service creation, driver loading, process creation, PowerShell, scheduled tasks, and logon events |
| EDR console | Agent health changes, tamper alerts, last-seen timestamps, sensor uninstall attempts, and policy changes |
| Identity systems | Privileged account use, impossible travel, new group membership, and abnormal lateral logons |
| Network telemetry | Remote administration traffic, SMB transfers, command-and-control sessions, and unusual outbound downloads |
Detection content should focus on behavior rather than a single filename or hash, since operators can rename binaries, recompile loaders, or swap vulnerable drivers. Stronger rules combine several conditions: a new driver from a suspicious path, service control activity against security tools, privileged remote logon, and a rapid loss of endpoint telemetry. When those signals appear together, teams should isolate affected hosts, preserve volatile evidence, rotate exposed credentials, and verify the integrity of backups before ransomware deployment can proceed.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Hardening Steps for Security Teams
Security teams should treat EDR-killing activity as a pre-ransomware event and harden around the assumption that attackers may obtain local administrator rights before launching the tool. The goal is to make driver abuse, service tampering, and mass process termination harder to execute, easier to spot, and less useful to the attacker. That means combining operating system controls, EDR self-protection, identity restrictions, and rapid isolation playbooks rather than relying on a single alert.
Free tools Windows power users keep installed
One-click scans. No signup required.
Reduce the chance of vulnerable driver abuse
Many EDR killer tools rely on bringing a signed but vulnerable driver into the environment, then using that driver to interfere with protected security processes. Defenders should enable Microsoft’s vulnerable driver blocklist where supported, apply Windows Defender Application Control or a similar application control policy, and restrict the loading of unsigned or unapproved kernel drivers. Driver allowlists should be reviewed against business needs, especially on servers and administrator workstations where attackers often stage tooling.
- Enable driver blocklists: Use Microsoft’s recommended vulnerable driver blocklist and keep Windows security baselines current.
- Control driver loading: Use WDAC, App Control for Business, or equivalent controls to prevent untrusted driver installation.
- Monitor new driver creation: Alert on suspicious .sys files written to temporary folders, user profiles, public directories, or unusual service paths.
- Restrict administrative tooling: Limit who can install drivers, create services, stop services, or modify security product directories.
Strengthen EDR self-protection and tamper resistance
EDR platforms should be configured with the strongest available tamper protection, including password-protected uninstall, protected service settings, and cloud-enforced policy where the vendor supports it. Security teams should verify that local administrators cannot silently disable sensors, remove agents, or stop security services without generating an alert. If the product supports protected mode, kernel callbacks, anti-tamper tokens, or management-console approval for uninstall actions, those settings should be enabled and periodically tested.
Organizations should also avoid leaving older sensor versions deployed for long periods. Ransomware operators often test their tools against common EDR products, and older agents may lack recent protections against bring-your-own-vulnerable-driver techniques. Patch cadence for endpoint agents should be tracked like operating system patching, with coverage dashboards for offline devices, servers, virtual desktop images, and gold images used for provisioning.
Limit attacker privileges before the tool runs
Because EDR termination tools usually require elevated privileges, privilege management is a major control point. Remove standing local administrator rights wherever possible, rotate local admin passwords with LAPS or an equivalent tool, and monitor for sudden membership changes in privileged groups. Administrative sessions should be separated from email, browsing, and daily productivity work. For domain and cloud administrators, enforce phishing-resistant multifactor authentication and conditional access rules that reduce the risk of credential replay from compromised hosts.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11| Control area | Hardening action | Expected defensive value |
|---|---|---|
| Driver control | Block known vulnerable drivers and restrict new driver installs | Prevents common kernel-abuse paths used to terminate EDR |
| EDR configuration | Enable tamper protection, protected uninstall, and policy lock | Makes sensor shutdown noisy and harder to complete |
| Privileges | Remove standing admin rights and monitor privileged group changes | Limits who can execute EDR-killing tools successfully |
| Response | Auto-isolate hosts after security service stop attempts or driver abuse | Contains ransomware staging before encryption begins |
Detection engineering should turn hardening gaps into response triggers. Alerts for unexpected EDR service stops, driver installation events, process handle access to security tools, or command-line attempts to kill mulle security processes should be routed as high-severity incidents. Where supported, automated containment can isolate the host, preserve volatile evidence, and block lateral movement while responders investigate. Teams should test these controls through purple-team exercises that simulate service tampering and vulnerable driver loading, then tune alerting so the earliest signs of EDR interference are acted on before ransomware deployment begins.
Best Value
Frequently Asked Questions
What is an EDR killer, and how is it different from normal malware?
An EDR killer is a tool designed specifically to disable, blind, or terminate endpoint detection and response software before the main intrusion activity begins. Instead of immediately encrypting files or stealing data, it removes the security controls that would normally detect those actions. Ransomware crews use it to create a short window where lateral movement, credential theft, and payload deployment are less likely to be blocked.
How can a tool shut down EDR if the attacker does not have admin access?
Most EDR-killing techniques still require elevated privileges, kernel-level access, or abuse of a vulnerable signed driver. Attackers often gain those rights first through stolen admin credentials, privilege escalation, or remote management tools already present in the environment. Once they can load or abuse a driver, they may terminate protected processes, block telemetry, or interfere with security agent services.
Which security products are at risk from this kind of technique?
The risk is usually tied less to one vendor and more to whether the attacker can abuse a driver or system component that allows process termination at a low level. Reports on these tools often list mulle affected EDR, antivirus, and endpoint security products because the tool targets common process and service behaviors. Security teams should check vendor advisories, agent tamper-protection settings, and whether their product detects known vulnerable-driver abuse.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →What signs should defenders look for before ransomware is deployed?
High-value clues include unexpected driver loads, attempts to stop security services, sudden gaps in endpoint telemetry, and command-line activity aimed at killing processes. Teams should also investigate new scheduled tasks, remote execution from admin tools, unusual use of legitimate drivers, and endpoint agents that stop reporting at the same time across mulle hosts. These events often appear shortly before ransomware deployment or data theft activity accelerates.
How can security teams harden systems against EDR-killing tools?
Enable tamper protection in the endpoint security platform and restrict who can disable or modify agents. Block known vulnerable drivers using Microsoft’s vulnerable driver blocklist, application control, or equivalent allowlisting controls. Teams should also limit local administrator rights, monitor driver installation events, protect remote management tools with MFA and logging, and test whether alerts fire when endpoint services are stopped or telemetry disappears.
Bottom Line
Tools built or adopted by ransomware crews to kill EDR are now a practical pre-attack step, not a niche tactic. By abusing vulnerable drivers, trusted privileges, or tampering gaps, attackers can blind security controls just before encryption, data theft, or hands-on-keyboard intrusion activity begins.
Security teams should treat EDR tampering as a high-priority detection category: monitor for suspicious driver loads, protection-state changes, service terminations, and unusual kernel-level activity. The next step is to validate your controls against these behaviors, patch or block vulnerable drivers, enforce tamper protection, and rehearse response actions for when endpoint visibility suddenly drops.
Recommended Free Tools
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
