Loading malware…
AuKill is a Windows defense-evasion malware/tool used to disable endpoint security products via a bring-your-own-vulnerable-driver (BYOVD) technique. It abuses an outdated Microsoft Sysinternals Process Explorer driver from Process Explorer version 16.32 to terminate protected security processes. Sophos X-Ops investigated multiple AuKill incidents and linked its use to at least three ransomware intrusions in early 2023, including Medusa Locker and LockBit, where it was used before deployment of ransomware or backdoors. The tool has also been described as commercially sold on criminal marketplaces, and reporting links its development to FIN7, which is said to have developed AuKill under the alternate name AvNeutralizer.
High-confidence behavior described in the source includes dropping a vulnerable driver as PROCEXP.SYS into C:\Windows\System32\drivers, dropping a copy of its executable into System32 or TEMP, and installing/running itself as a service. AuKill requires administrative privileges and does not itself provide initial admin access. It checks for the command-line keyword "startkey" and validates it via a simple arithmetic routine. If not already running as SYSTEM, it attempts to relaunch with higher privileges by impersonating TrustedInstaller.exe, including starting the Trusted Installer service, duplicating its token, and invoking CreateProcessWithTokenW. Once active, AuKill continuously monitors for targeted security components using multiple threads, terminates processes by sending IOCTL_CLOSE_HANDLE to the vulnerable Process Explorer driver, disables services via ChangeServiceConfigW with SERVICE_DISABLED, and in newer variants attempts to unload targeted drivers with NtUnloadDriver and delete related registry service keys under System\CurrentControlSet\Services.
Sophos collected six AuKill variants, showing development from at least November 2022 through February 2023. The reporting notes strong similarities to the open-source Backstab tool, including nearly identical driver-interaction logic and debug strings, indicating code or technique reuse. Related reporting also mentions similar tooling such as MalVirt using the same Process Explorer driver. AuKill is commonly characterized as an EDR killer and is repeatedly cited alongside other BYOVD tools such as TrueSightKiller, GhostDriver, Poortry, and Terminator. Sophos detection names mentioned in the content include ATK/BackStab-D, with additional behavioral protections also referenced.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
FIN7 also developed AuKill (also known as AvNeutralizer), a custom EDR evasion utility designed to disable endpoint security solutions, which was later reported to have been offered for sale by the group on criminal marketplaces.
Sophos X-Ops has investigated multiple incidents where attackers attempted to disable EDR clients with a new defense evasion tool we’ve dubbed AuKill. The AuKill tool abuses an outdated version of the driver used by version 16.32 of the Microsoft utility, Process Explorer, to disable EDR processes before deploying either a backdoor or ransomware on the target system.
18 distinct techniques documented for this family, organized by ATT&CK tactic.
For each driver name, AuKill tries to unload it via calling NtUnloadDriver and deleting the corresponding registry key in the hive System\CurrentControlSet\Services\[DRIVER_NAME].
By leveraging a vulnerable driver, attackers can execute malicious actions in kernel mode. For example, after gaining administrative access, an attacker can install a signed but flawed driver and send it crafted commands to exploit its weaknesses. | Attackers are increasingly abusing trusted Windows drivers to turn off antivirus (AV) and endpoint detection and response (EDR) tools, using a technique known as Bring Your Own Vulnerable Driver (BYOVD).
Then it duplicates the token of TrustedInstaller.exe using the DuplicateTokenW WINAPI function, and passes the token to CreateProcessWithTokenW to elevate itself to SYSTEM once the process restarts.
Then it duplicates the token of TrustedInstaller.exe using the DuplicateTokenW WINAPI function, and passes the token to CreateProcessWithTokenW to elevate itself to SYSTEM once the process restarts.
For each service name in the list, AuKill checks if it exists, and if it does, disables it by calling ChangeServiceConfigW and passing SERVICE_DISABLED for dwStartType.
“This tool has been found in the wild as a packed payload… analysis of the associated private packer… ‘PackXOR’… The aim of packing is to hinder the work of malware analysts and antivirus/EDR software, by concealing payloads and delaying their detection.”
AuKill drops a driver named PROCEXP.SYS (from the release version 16.32 of process Explorer) into the C:\Windows\System32\drivers path. The legitimate Process Explorer driver is named PROCEXP152.sys, and normally is found in the same location.
For each driver name, AuKill tries to unload it via calling NtUnloadDriver and deleting the corresponding registry key in the hive System\CurrentControlSet\Services\[DRIVER_NAME].
FIN7 also developed AuKill (also known as AvNeutralizer), a custom EDR evasion utility designed to disable endpoint security solutions...
Then it duplicates the token of TrustedInstaller.exe using the DuplicateTokenW WINAPI function, and passes the token to CreateProcessWithTokenW to elevate itself to SYSTEM once the process restarts.
7 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
19 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A malicious tool associated with BYOVD tradecraft that leverages vulnerable signed drivers to terminate or impair endpoint security processes.
Malware referenced as abusing the Process Explorer driver to kill or bypass EDR protections.
Process Explorerの正規ドライバを悪用してEDR/セキュリティ製品を停止させるEDR Killerマルウェア。ランサムウェア展開前の防御無効化に使われる。
BYOVD-associated defense-evasion tool referenced as commonly used by ransomware groups to disable security products prior to encryption.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.