EDR Killers: How Modern Attacks Are Outpacing Traditional Defenses

Scott Fuhriman

Endpoint Detection and Response (EDR) solutions have become a necessary final line of defense on endpoints. They monitor processes, flag anomalies, respond automatically to suspicious activity, and provide important telematics for incident responders. But attackers have been adapting as effectiveness in EDR technology has increased. Today, an entire class of tools exist whose sole purpose is to evade, neutralize, or “kill” EDR protections. The attackers are directly attacking the security tools and, without the addition of a deeper defensive layer, they will continue to have success.

A Timeline of Notable EDR Killers

AuKill – June 2022: In-memory attacks that bypassed multiple agent hooks without leaving files on disk.
EDRSandblast – April 2022: Simultaneously evaded signature and heuristic detection, demonstrating the limits of static monitoring.
ProcBurner – November 2022: Exploited privileged process injection to silently terminate monitoring agents.
Terminator – May 2023: Leveraged kernel-level manipulation to blind EDR entirely.
EDRKillShifter – August 2024: Introduced living-off-the-land techniques, running legitimate system utilities to avoid alerts.
MS4Killer – October 2024: Targeted Microsoft Defender at scale, bypassing cloud telemetry and endpoint hooks.
Defendnot – May 2025: The most advanced to date, evading runtime attestation and kernel-level integrity checks.
New Unnamed Killer – Aug 2025: Custom build binary to kill various EDR vendors used by multiple ransomware gangs, including Blacksuit, RansomHug, Medusa, Qilin, Dragonforce, Crytox, Lynx, INC [1].

‍

Each successive tool illustrates a clear evolution: attacks are going deeper into system internals, using memory-only techniques, kernel manipulation, and legitimate certificates, drivers, and processes to evade detection.

This should make sense because as the EDR tools have improved there is a door attackers have used throughout history for deep access and when successful will give unfettered control: the operating system kernel.

This is the underlying control center of an operating system, applications, and hardware. Most of the kernel runs in-memory, which is a very complex and dynamic environment and makes it hard to watch and protect - the perfect place to hide and carry out mayhem.

Also concerning is the recent evidence reported, by multiple research groups, indicating that cybercriminals are collaborating [1]; as are nation-state actors with cybercriminals in an ever-escalating battle between defenders and attackers [2].

The Strategic Implications

For organizations rightfully relying on EDR, this evolution in attack approach highlights a critical blind spot in security controls and posture. The kernel has insufficient protection for the highest privileged area, where everything assumes the kernel can be trusted and believes whatever the kernel says to be true.

I have to say here, there are some protection capabilities for the kernel that have been created and implemented by the operating system vendors and maintainers [3][4]. The problem is these implementations do not provide comprehensive coverage, have performance impacts, can also have vulnerabilities, and are based on addressing previously known attack techniques.

To put it simply, if the kernel is compromised or privileged access is achieved, the actions and information EDR trusts from the kernel becomes unreliable and the EDR and other security tools utilized can’t be trusted. What looks to be normal and status quo may be a carefully crafted attack bypassing every detection and protection mechanism.

EDR is necessary, but not sufficient. It can detect many threats, but not those that target the foundation itself.
Fileless and in-memory attacks are now dominant. These attacks leave no artifacts and aid in successful evasion of existing defenses.
Kernel-level threats are rising. Manipulation of the OS kernel, BYOVD, eBPF, and other techniques can blind, bypass, and even disable EDR functionality.

‍

What Security Leaders & Teams Must Do

To counter EDR Killers, CISOs and security teams need to shift focus from known threat detection and prevention alone and include a foundational layer of verification of a system’s integrity which includes:

Continuous Runtime Integrity: Measure and validate kernel memory and structure comprehensively at runtime. Detect any kernel impacting changes immediately. Expose stealthy attacks early and respond faster to minimize blast radius.
Kernel Attestation: Ensure that what EDR monitors is trustworthy. EDR without a verified foundation can be blinded and made ineffective. Know that the doors are and remain secured to the control center.
Layered Security: Runtime Integrity is not a replacement for a well implemented and maintained layered defense. However, Runtime Integrity must become a part of that layered defense to remove the assumption of trust made by the security stack.

‍

EDR remains a critical component of any security strategy. But as the history of EDR Killers show, relying on them without knowing the state of the kernel leaves organizations exposed and the door open to attacks that operate beneath its visibility. Securing the kernel and runtime environment at the foundation of your system is now possible, and it is not optional. It is the only way to ensure that EDR and your entire security stack are actually seeing and receiving what you think they are.

‍

Closing Thought

Attackers are increasingly focused on targeting the security that protects systems. Without a way to independently verify that a system kernel has integrity, meaning has not been tampered with, you are only assuming a security posture. Furthermore, you’re leaving a known door for attacks inadequately secured with limited visibility of access. Organizations that embrace Runtime Integrity and kernel-level attestation gain visibility where EDR cannot adequately see in the ongoing battle for endpoint security.

‍

Sources:

1. Shared Secret: EDR killer in the kill chain https://news.sophos.com/en-us/2025/08/06/shared-secret-edr-killer-in-the-kill-chain/

2. Nation State Actors Increasingly Hide Behind Cybercriminal Tactics and Malware https://www.csoonline.com/article/3595792/nation-state-actors-increasingly-hide-behind-cybercriminal-tactics-and-malware.html

3. An In-depth Look at Windows Kernel Threats
https://documents.trendmicro.com/assets/white_papers/wp-an-in-depth-look-at-windows-kernel-threats.pdf

4. Overview of Linux Kernel Security Features
https://www.linux.com/training-tutorials/overview-linux-kernel-security-features/

‍