• by Admin

Attackers Are Switching Off Your EDR. Here’s How.

The Guard Who Was Told to Go Home

Imagine a burglar who does not pick the lock or climb the fence. Instead, he shows up with a genuine, signed work order and politely asks the security guard to step away. The guard, trained to trust official paperwork, does. Then the burglar walks in.

That, roughly, is what happens in a Bring Your Own Vulnerable Driver attack, usually shortened to BYOVD. It is the reason some breaches begin with endpoint detection quietly going silent.

How the Trick Works

Drivers run with deep privileges on a machine. Some older but legitimately signed drivers contain flaws, and an attacker who already has a foothold can bring one along, load it, and exploit the flaw to gain the power to stop security software. Because the driver is properly signed, the operating system often lets it in without complaint.

What makes this a growing concern, as SentinelOne describes, is how routine it has become. Tools for killing EDR have turned into something close to a marketplace, which means attackers no longer need advanced skills to use them. The technique has gone from a specialist's trick to a repeatable service.

Indonesia has already seen high-profile ransomware incidents in recent years, and attackers rarely care how large the target is. Mid-sized companies with a thin security team are often the easiest way in.

Closing the Door

No single control solves this, but several together make it much harder. Turn on the tamper protection your endpoint product offers, so its processes resist being stopped. Keep driver blocklists current so known vulnerable drivers cannot be loaded in the first place. Watch for unusual driver installs and sudden gaps in endpoint telemetry, since a silent agent can be a warning sign in itself. And accept that no endpoint tool should be the only thing standing between an attacker and your data.

It is also worth asking an uncomfortable question: if your EDR stopped reporting from a laptop tonight, how long before anyone noticed?

Keeping the Guard on Duty

No single control stops this, so Perkom and SentinelOne work in layers. The Singularity platform watches endpoint behavior instead of relying only on known malware, and its tamper protection makes it harder for an attacker to switch the agent off. Perkom then checks that those protections and policies are actually enabled and consistent across your devices, and that blocklists and hardening settings are reviewed alongside them.

Perkom also sets up alerts for endpoints that go quiet, because a laptop that suddenly stops reporting should be looked at within hours, not weeks. A short endpoint health check is a simple way to see how exposed you are today.

Author: Ghea Devita, Marketing Communication PT Perkom Indah Murni