GentleKiller — The Gentlemen's BYOVD EDR-Killer Framework

GentleKiller is an in-house, operator-maintained EDR-killer framework distributed by The Gentlemen ransomware-as-a-service crew to vetted affiliates, detailed by ESET on 2026-06-17 (corroborated by a May 2026 internal-data leak). It exists to tear down endpoint defenses immediately before ransomware encryption. It ships at least eight distinct variants, each impersonating a legitimate security product (fake version info, copied certificates and icons) and abusing a different Bring-Your-Own-Vulnerable-Driver (BYOVD) kernel driver to terminate protected processes from kernel space — bypassing user-mode tamper protection.

In total GentleKiller targets 400+ processes mapped to 48 security products — including Microsoft Defender, CrowdStrike, SentinelOne, Sophos, Palo Alto, ESET, Bitdefender, Kaspersky and McAfee/Trellix. Variants load signed-but-exploitable drivers (e.g. eb.sys, nseckrnl.sys, vgk.sys, stpm_old.sys/stpm_new.sys, dmx.sys, 360netmon_wfp.sys) then run a kill loop every ~2 seconds, periodically re-terminating any security process that respawns. Binaries are packed with Enigma and Themida; the crew also folds in leaked third-party killers (HexKiller, ThrottleBlood, HavocKiller) and pairs the framework with a Rust credential stealer, OxideHarvest. Notably, Gentlemen operationalizes newly published BYOVD PoCs within days.

Defender priority: Your EDR is the target. The detection that matters most is catching the BYOVD step before the kill loop succeeds — a known-vulnerable .sys driver being written and a kernel service registered for it, paired with the abrupt termination of multiple security processes. Enable Falcon sensor tamper-protection + the Vulnerable Driver blocklist (HVCI/WDAC), and alert on any sensor-health/heartbeat gap as a possible successful kill.

Web-hunter note: ESET published SHA-1 hashes (not SHA-256/MD5). Falcon Custom IOC import accepts SHA-256/MD5 only, so the SHA-1 set is provided in the appendix for YARA / retro-hunt / threat-intel matching, and the CQL hunts key on driver/binary filenames + behavior rather than hash. Re-derive SHA-256 from your own samples before promoting to a prevent IOC. This pack scopes the EDR-killer tooling; the broader Gentlemen ransomware lifecycle is covered separately.

Hunt hypotheses (ordered by fidelity)

1. H1 (high): A known-vulnerable driver (.sys) from the GentleKiller set is written to disk and/or a kernel service is created for it. → Q1, Q2
2. H2 (high): Multiple security/EDR processes terminate within a short window (the ~2s kill loop). → Q5
3. H3 (high): A binary masquerading as a security vendor (fake version info) executes from a non-standard path. → Q3
4. H4 (medium): A .sys driver loads/installs from a user-writable directory (Temp/ProgramData/Downloads). → Q2, Q7
5. H5 (medium): A Themida/Enigma-packed executable runs and immediately opens handles to many AV processes. → Q3, Q4
6. H6 (medium): OxideHarvest reads Chromium/Gecko credential stores around the same intrusion window. → Q6
7. H7 (high): Falcon sensor heartbeat/health gap coincides with one of the above (possible successful kill). → Native (s7)

Attack chain

All hashes are ESET-published SHA-1 (verbatim). Use for retro-hunt / YARA; re-derive SHA-256 for Falcon IOC import. Full lists in the appendix (s10).

• Falcon sensor health (cloud-side): Alert on any host whose sensor stops reporting / goes RFM / heartbeat gaps unexpectedly — a successful kill blinds local telemetry, so the absence of data is the signal. Cross-reference with Q1–Q5 hits just before the gap.
• Windows System log (Event ID 7045): New kernel-mode service install referencing a .sys in a user-writable path. Event ID 7000/7001 for driver service start failures (BYOVD often noisy).
• Code Integrity (Event ID 3033/3023): HVCI/WDAC blocks of unsigned or blocklisted drivers — these are direct BYOVD-attempt evidence.
• Microsoft vulnerable-driver blocklist: Confirm the blocklist is enabled; review blocked-load events for the named drivers.
• Defender tamper alerts: If any host still runs Defender, surface "tampering"/"service stopped" alerts as corroboration.

Best defense is prevention at the driver layer: enable the Microsoft vulnerable-driver blocklist + Falcon's vuln-driver protection so the named drivers fail to load even before the IOA fires.

• Telemetry ready: Confirm PeFileWritten, ServiceInstalled, and EndOfProcess are flowing; verify cloud-side sensor-health alerting is configured (detection-by-absence depends on it).
• Benign baseline: Run Q2/Q5/Q7 for 7 days, catalog legitimate driver installs (GPU/AV/VPN agents) and maintenance-window service stops; build exclusions.
• Positive tests: In an isolated VM, attempt to load one blocklisted driver (e.g. via a known BYOVD test harness) to confirm Q1/Q2 + CodeIntegrity 3033 fire.
• Promotion: Q1 and Q3 (named IOCs) → Custom IOA Prevent immediately; Q5 → Detect after baselining the kill-burst threshold.

1 · Enable the Microsoft vulnerable-driver blocklist (PowerShell, admin)

# Windows 11 / Server 2022+: ensure the blocklist policy is applied
# Check current state
Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard |
  Select-Object -ExpandProperty SecurityServicesRunning
# Enable Memory Integrity (HVCI) via registry, then reboot
# HVCI needs VBS enabled as well -- the scenario key alone is inert and the
# control silently never activates. All three values are required.
$dg = "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard"
New-Item -Path $dg -Force | Out-Null
Set-ItemProperty -Path $dg -Name "EnableVirtualizationBasedSecurity" -Value 1 -Type DWord
Set-ItemProperty -Path $dg -Name "RequirePlatformSecurityFeatures" -Value 1 -Type DWord
# Prereqs: UEFI + Secure Boot + virtualization extensions. Reboot required.
# PILOT FIRST -- incompatible legacy drivers can block boot under HVCI.
# Rollback: set all three values to 0 and reboot; from Safe Mode or WinRE if it will not boot.
$p = "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity"
New-Item -Path $p -Force | Out-Null
Set-ItemProperty -Path $p -Name "Enabled" -Value 1 -Type DWord

2 · Hunt installed services for blocklisted drivers (PowerShell)

$bad = 'eb.sys','nseckrnl.sys','vgk.sys','stpm_old.sys','stpm_new.sys','dmx.sys',
       '360netmon_wfp.sys','googleApiUtil64.sys','ThrottleBlood.sys','havoc.sys','G11.sys'
Get-CimInstance Win32_SystemDriver |
  Where-Object { $bad -contains (Split-Path $_.PathName -Leaf) } |
  Select-Object Name, State, PathName

3 · Enforce Falcon sensor uninstall/anti-tamper (Prevention Policy)

# In Falcon console: Endpoint security > Prevention policies
#   - Sensor Visibility: ON
#   - Additional User Mode Data: ON
#   - "Uninstall Protection" (Sensor Update Policy): ON, set maintenance token
#   - Quarantine + USB policy as applicable
# Verify no host has anti-tamper disabled:
#   Host management > filter: "Sensor tags / RFM" review weekly

Validation: Coverage on the BYOVD teardown chain (drop → service → run → kill) is strong and largely promotable to Prevent IOAs, backed by driver-layer blocking. The residual gaps are the post-kill blind window (covered by detection-by-absence in s7) and the encryption stage (out of scope here — see the Gentlemen ransomware pack).