EDRSandBlast

EDRSandBlast is an open-source EDR-killing and defense-evasion tool used to disable endpoint security products at the kernel level via bring-your-own-vulnerable-driver (BYOVD) techniques. The provided reporting states it has been used by multiple threat actors, including in Qilin ransomware intrusions and by Russian SVR/APT29 operators during post-exploitation of JetBrains TeamCity compromises. In observed Qilin activity, attackers deployed a legitimate signed Carbon Black Cloud Sensor executable (upd.exe) to sideload a malicious avupdate.dll, which decoded an XOR-encoded payload (web.dat) into a customized EDRSandBlast variant. That customized variant used the signed Toshiba driver TPwSav.sys rather than the tool’s more commonly associated vulnerable drivers, abused the driver’s arbitrary physical memory read/write capability, hijacked Beep.sys for arbitrary kernel memory access, and removed kernel callback routines and kernel event tracing used by EDR products. Reporting also notes EDRSandBlast can be used to disable or kill EDR/AV products and remove Protected Process Light (PPL) protections. Sophos reporting cited it as one of the most frequently seen EDR killer tools in 2024, appearing in waves of attempted ransomware attacks, with a notable peak around the U.S. Thanksgiving period. High-confidence observables directly tied to the described customized deployment include upd.exe, avupdate.dll, web.dat, and TPwSav.sys.