EnPortv.sys

EnPortv.sys refers to an EDR-killer tool observed abusing the legitimate but vulnerable/revoked Guidance Software EnCase kernel driver EnPortv.sys in a Bring Your Own Vulnerable Driver (BYOVD) technique to disable security products on Windows systems. In the reported Huntress incident, the malware was a 64-bit executable disguised as a legitimate firmware update utility. It installed the old EnCase driver as a fake OEM hardware service to achieve reboot-resistant persistence, then used the driver’s kernel-mode IOCTL interface to terminate security processes, including bypassing Protected Process Light (PPL). The tool reportedly targeted 59 EDR- and antivirus-related processes and ran a kill loop every second to terminate restarted defenses. The intrusion in which it was used began with compromised SonicWall SSL VPN credentials on an account without MFA, followed by internal reconnaissance including ping sweeps, NetBIOS probes, SMB activity, and high-rate SYN flooding. Huntress assessed the activity as likely ransomware-related, although the final payload was not deployed before the intrusion was disrupted. High-confidence indicators and traits directly mentioned include abuse of the EnPortv.sys EnCase driver, use of a revoked certificate that Windows still accepted due to legacy signing/timestamp behavior, masquerading as an OEM hardware service, and repeated termination of security tooling from kernel mode.