An uphill struggle
I was just reading ESET's blog about how to prevent EDR killers and the tasks outlined are pretty significant for a number of businesses.
High-quality EDR is a must – An EDR killer is a sophisticated attack tool; likewise, a cybersecurity solution deployed on the targeted endpoint needs to be top-grade. That means it should have detections for the malicious code abusing the vulnerable driver, even prior to execution. However, due to heavy obfuscation or other evasion techniques, this may not always be feasible.
Tamper protection – This prevents unauthorized users from disabling or modifying the components or capabilities of a security solution.
Blocking vulnerable drivers – This can be achieved through strict policies regarding potentially unsafe applications (PUSA) and file-based detections. To avoid system disruption, consider starting with a “Detect but don’t clean” mode, then adding exclusions as needed, and finally switching to a “Detect and clean” mode.
Vulnerability and patch management – Sophisticated threat actors may try to abuse a vulnerable driver already present on the compromised machine instead of relying on BYOVD. Therefore, having proper patch management in place is another effective method of defense.
Harden Application Control– Improve your defenses via application control. For example via Windows Defender Application Control (WDAC), where you can create a policy that allows only selected drivers to be loaded. Other platforms leverage technologies like ESET’s Host-based Intrusion Prevention System, which uses a “Rule” to block an application.
Limit access to endpoint security settings – Using a strong password to lock these settings adds another layer of protection.
Know your environment – These tools require considerable focus and knowledge of protected systems to avoid interfering with legitimate software and causing business disruptions.
Quite a bit to do.
Biting the hand that feeds IT
