Microsoft Malicious Software Removal Tool 5.116 free

Scripting used to load a malicious EDR-killer driver and set up persistence

Sophos endpoint products were among the security tools that were targeted. In our December story about malicious signed drivers, that’s exactly what we discovered attackers were doing – they would use their previously-obtained Administrator privileges to set up the drivers to load during the boot process, before security software was running, and once they were loaded, the drivers would sabotage various types of security (and other) applications, preventing them from running as designed. Depending on how they are created and installed, drivers can load before other parts of an operating system (including endpoint security software) can start. This is important because the nature of third-party drivers is that they function almost as operating system components, at a very low level. (More information about the detections appears at the bottom of this article.)Īs part of the security model for the most recent generations of 64-bit Windows, Microsoft instituted a policy in 2016 (beginning with Windows 10, version 1607), that kernel drivers must carry a valid digital signature before a Windows operating system with Secure Boot enabled will load them.

Sophos has had protection measures in place since 2022 that could detect the presence of, and block the installation of, these drivers. They also released Knowledge Base article 5029033, which includes new, more detailed information on the technical measures Microsoft has taken to protect against these malicious signed drivers. Today, Microsoft issued Security Advisory ADV230001 as part of their July Windows Update that addresses Sophos’ discovery of more than 100 malicious drivers that had been digitally signed by Microsoft and others, dating as far back as April 2021. In December 2022, Microsoft published their monthly Windows Update packages that included an advisory about malicious drivers, signed by Microsoft and other code-signing authorities, that Sophos X-Ops (and others) observed threat actors abusing during attacks.

Microsoft Malicious Software Removal Tool 5.116 free