Abusing Legitimate Low-Level Tools to Help Ransomware Evade Antivirus Detection

Summary

The article explains how ransomware operators abuse legitimate low-level utilities such as Process Hacker, IOBit Unlocker, PowerRun, and similar tools to weaken antivirus and endpoint protection. By misusing these signed binaries, attackers can obtain SYSTEM or even kernel-level privileges, steal credentials, and ready the environment for ransomware deployment. The piece highlights how AV neutralization has evolved from basic scripts into bundled capability sets inside modern Ransomware-as-a-Service offerings. It also references real-world ransomware groups that have adopted these methods.

Investigation

The investigation describes a two-step intrusion pattern in which adversaries first use low-level tools for privilege escalation and antivirus evasion, then pivot to credential theft, kernel tampering, and execution of the ransomware payload. Tool activity is mapped to MITRE ATT&CK techniques including T1548.002, T1562.001, and T1003.001. Case examples connect these utilities to ransomware operations such as LockBit 3.0, Phobos, MedusaLocker, and others.

Mitigation

Recommended mitigations include enforcing application allowlisting, watching for large-scale process termination, auditing registry changes that affect antivirus settings, and limiting execution of administrative utilities to approved accounts only. Endpoint protection platforms should also strengthen self-protection controls to resist forced shutdown of security processes and services.

Response

When this behavior is detected, organizations should alert on suspicious AV or EDR process termination, isolate the impacted host, preserve forensic evidence of registry and file changes, and investigate for LSASS access tied to credential theft. Incident response should follow the observed kill chain quickly enough to contain the intrusion before ransomware encryption begins.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

• Attack Narrative & Commands:

  The adversary has obtained administrative rights on the victim host and wants to neutralize the endpoint protection before deploying ransomware payloads. Using the legitimate utility HRSword.exe, they issue a command that stops the antivirus service (avservice) and disables its automatic restart, ensuring the defender cannot recover the service during the attack window. The command is executed directly in a PowerShell console to generate a clear Sysmon process‑creation event that matches the detection rule.

• Regression Test Script:

  <# 
  Simulation of HRSword.exe usage to stop an AV service and disable its restart.
  This script must be run with elevated (Administrator) privileges.
  #>
  
  # Variables
  $hrswordPath = "$env:ProgramFilesHRSwordHRSword.exe"
  $serviceName = "avservice"
  
  # Ensure HRSword.exe exists (create a mock if not)
  if (-Not (Test-Path $hrswordPath)) {
      Write-Host "Creating mock HRSword.exe for simulation..."
      # Create a dummy executable (a copy of cmd.exe) just for logging purposes
      Copy-Item "$env:windirSystem32cmd.exe" $hrswordPath -Force
  }
  
  # Execute the exact command line that the Sigma rule watches
  $command = "& `"$hrswordPath`" /service stop $serviceName /disable"
  Write-Host "Executing: $command"
  Invoke-Expression $command
  
  # Optional: Log a custom event to indicate completion (helps verify end‑to‑end)
  Write-EventLog -LogName Application -Source "HRSwordSimulation" -EventId 3000 -EntryType Information -Message "HRSword service stop simulation completed."

• Cleanup Commands:

  <#
  Restore the AV service to its original state and remove the mock executable.
  #>
  
  # Restart the AV service (if it exists)
  $serviceName = "avservice"
  if (Get-Service -Name $serviceName -ErrorAction SilentlyContinue) {
      Write-Host "Restarting service $serviceName ..."
      Start-Service -Name $serviceName -ErrorAction SilentlyContinue
  }
  
  # Remove the mock HRSword.exe (if it was created)
  $hrswordPath = "$env:ProgramFilesHRSwordHRSword.exe"
  if (Test-Path $hrswordPath) {
      Write-Host "Removing mock HRSword.exe ..."
      Remove-Item $hrswordPath -Force
  }
  
  # Clear the custom event log entry
  Get-EventLog -LogName Application -Source "HRSwordSimulation" -After (Get-Date).AddMinutes(-10) | Remove-EventLog