What is an EDR killer (and BYOVD)?

Why attackers go after the security tool first

As endpoint detection and response became the standard defense on laptops and servers, attackers faced a problem: EDR is good at spotting ransomware behavior, so deploying ransomware while EDR is watching risks being caught and stopped. Their solution was direct. Rather than trying to sneak past the security tool, they increasingly try to turn it off entirely before they strike. A whole class of attacker tooling, loosely called EDR killers, exists for exactly this purpose: to disable, blind, or unload the endpoint agent so that when the ransomware runs, nothing is watching.

This is a significant shift in the threat. It means the endpoint agent, the thing many organizations rely on as their primary defense, has itself become a target. An attacker who successfully kills the EDR has removed the defender's visibility at the critical moment, and if that agent was the whole defense, there is nothing left to catch what happens next.

BYOVD: bring your own vulnerable driver

The most prominent technique for killing EDR is known as BYOVD, short for bring your own vulnerable driver. To understand it, you need to know that security software runs with very high privileges deep in the operating system, specifically to protect itself from being tampered with. To disable it, an attacker needs that same deep level of access, which ordinary malware does not have.

BYOVD is the clever and dangerous way attackers obtain it. They bring with them a legitimate, digitally signed device driver, a real piece of software from a real vendor, that happens to contain a security flaw. Because the driver is legitimately signed, the operating system trusts it and loads it into the deepest, most privileged layer. The attacker then exploits the flaw in that trusted driver to gain the same deep access, and uses it to reach in and switch off or blind the EDR. In effect, they smuggle a trusted-but-broken tool into the privileged core of the system and use it against the defender. Agencies including CISA have issued advisories on ransomware groups using exactly this technique.

The related rise of malware-free attacks

EDR killers sit alongside a broader trend that makes endpoint defense harder: attacks that use little or no malware at all. Rather than deploying files that an endpoint tool could recognize, attackers increasingly operate by living off the land, using the legitimate administrative tools already present on systems, and by relying on stolen valid credentials. Industry threat reporting has found that a large and growing majority of intrusions are now malware-free in this sense. Combine a malware-free intrusion with an EDR killer at the decisive moment, and a defense built solely on recognizing malicious files on the endpoint has very little to work with.

Why this makes a single layer dangerous

The lesson of EDR killers and BYOVD is not that EDR is worthless, it remains a valuable layer, but that no defense an attacker can simply switch off should ever be the only layer. If blinding one agent removes all of a defender's visibility and ability to respond, the attacker has a clear, repeatable path to victory: kill the agent, then encrypt freely.

This is the strategic argument for defense that does not live solely on the endpoint. Visibility and containment that operate at the network level cannot be uninstalled by an attacker who has taken over a host, because they do not depend on anything running on that host. A system watching network behavior still sees the lateral movement, the exfiltration, and the mass encryption even after the endpoint agent has gone dark, and can contain the threat from outside the compromised machine. Pairing endpoint tools with network-level detection and containment, and with recovery that does not depend on the endpoint at all, is the direct answer to an attacker who has learned to turn the endpoint defense off. The ability to be blinded in one place should never mean being blind everywhere.

How defenders respond to EDR killers

The security industry has not stood still in the face of EDR killers, and understanding the countermeasures helps clarify why a layered approach is the real answer. Operating-system vendors and security teams fight BYOVD by maintaining block-lists of known-vulnerable drivers, so the flawed drivers attackers rely on can no longer be loaded, and by tightening the rules around what gets to run in the privileged core of the system. EDR vendors add tamper-protection features that make their agents harder to disable and that raise an alert if someone tries. These measures genuinely help and should be kept current.

But this is an arms race, and it is an uneven one. Attackers continually find new vulnerable drivers to abuse and new ways to evade tamper protection, and defenders can only block what they already know about. Relying on winning that race on the endpoint is a fragile strategy, because the defender has to be right every time while the attacker only has to find one unblocked driver. The durable answer is architectural rather than reactive: ensure that even a complete success by the attacker on the endpoint, fully killing the agent, does not blind the whole defense. When network-level detection and containment keep operating regardless of what happens to the endpoint agent, and recovery does not depend on the endpoint either, the entire category of EDR-killer techniques loses its decisive power. The attacker can win the battle for the endpoint and still not win the war.