ThreatClaw · Investigation Playbook

osquery triage: Byovd edr killer vulnerable driver written to temporary path

osqueryRule sigma-byovd-edr-killer-vulnerable-driver-written-to-temporary-pathT1562T1562.001

  1. Run the investigation query

    Detects a known abusable kernel driver leveraged by EDR-killer tooling (EDRKillShifter and variants used by RansomHub, Medusa, Qilin, BlackSuit and INC) being written to a temporary or user-writable d osquery query (read-only) — platform(s): windows, tables: file. This query IS the collection step: SELECT * FROM file WHERE (path LIKE '%rwdrv.sys' ESCAPE '\' OR path LIKE '%hlpdrv.sys' ESCAPE '\' OR path LIKE '%truesight.sys' ESCAPE '\' OR path LIKE '%rentdrv2.sys' ESCAPE '\' OR path LIKE '%tfsysmon.sys' ESCAPE '\') AND (path LIKE '%/Windows/Temp/%' ESCAPE '\' OR path LIKE '%/AppData/Local/Temp/%' ESCAPE '\' OR path LIKE '%/ProgramData/%' ESCAPE '\' OR path LIKE '%/Users/Public/%' ESCAPE '\');

  2. Triage the results

    For each returned row:

    • Identify the host, the process/account and the timestamp
    • Determine whether the behavior is legitimate (baseline) or suspicious
    • ATT&CK context (tactic): Defense Evasion