SOC Prime Bias: Critical

09 Feb 2026 17:42
newspaper icon Huntress

They Got In Through SonicWall. Then They Tried to Kill Every Security Tool

Author Photo
Ruslan Mikhalov Chief of Threat Research at SOC Prime linkedin icon Follow
They Got In Through SonicWall. Then They Tried to Kill Every Security Tool
shield icon

Detection stack

  • AIDR
  • Alert
  • ETL
  • Query


Summary

In early February 2026, threat actors abused stolen SonicWall SSLVPN credentials to obtain initial access to a victim network. After establishing a foothold, they rolled out a custom EDR-killer that weaponized a legitimate EnCase forensic driver signed with a revoked certificate. Running in kernel mode, the driver was used to terminate security tooling at scale. The attacker dropped the driver to disk as a hidden system file and installed it as a kernel service, effectively sidestepping driver-signing protections. The intrusion was contained before the operators could pivot into ransomware deployment.

Investigation

Huntress examined VPN authentication records, confirmed successful logins from suspicious IP space, and correlated the access window with endpoint telemetry showing a 64-bit loader that delivered an encoded kernel driver. The loader decoded the driver, wrote it to C:\ProgramData\OEMFirmware\OemHwUpd.sys, and registered it as a service named OemHwUpd. The user-mode component then enumerated running processes, hashed process names, and repeatedly killed 59 known security-product processes by issuing IOCTL requests to the driver.

Mitigation

Enable MFA for all remote access and routinely audit VPN logs for anomalous sign-ins. Turn on Windows protections such as HVCI/Memory Integrity and apply WDAC driver block rules. Monitor for newly created services that masquerade as OEM or hardware-update components. Where possible, use ASR rules to prevent deployment of vulnerable-but-signed drivers.

Response

Alert on suspicious SSLVPN login patterns and on creation of OemHwUpd services or driver files under C:\ProgramData\OEMFirmware. Block unknown binaries that write or load kernel drivers and isolate impacted systems for triage. Remove the malicious service/driver, rotate exposed credentials, and enforce MFA to prevent re-entry.

"graph TB %% Class Definitions classDef technique fill:#99ccff classDef artifact fill:#ffe699 classDef service fill:#ffcc99 classDef driver fill:#ffcccc %% Nodes u2013 Artifacts artifact_credentials["<b>Artifact</b> – Stolen SonicWall SSLVPN credentials"] class artifact_credentials artifact artifact_network_recon["<b>Artifact</b> – Network reconnaissance data"] class artifact_network_recon artifact artifact_obfuscated_binary["<b>Artifact</b> – 64u2011bit binary with encoded driver"] class artifact_obfuscated_binary artifact artifact_driver_file["<b>Artifact</b> – C:\ProgramData\OEM\Firmware\OemHwUpd.sys"] class artifact_driver_file driver artifact_service["<b>Artifact</b> – Kernel service OemHwUpd"] class artifact_service service artifact_revoked_driver["<b>Artifact</b> – Signed revoked EnCase forensic driver"] class artifact_revoked_driver artifact %% Nodes u2013 Techniques tech_valid_accounts["<b>Technique</b> – T1078 Valid Accounts<br/><b>Description</b>: Use stolen VPN credentials to authenticate and gain initial foothold."] class tech_valid_accounts technique tech_remote_discovery["<b>Technique</b> – T1018 Remote System Discovery<br/><b>Description</b>: Perform ICMP ping sweeps, NetBIOS and SMB scans to map internal hosts."] class tech_remote_discovery technique tech_obfuscated["<b>Technique</b> – T1027.009 Obfuscated Files or Information: Embedded Payloads<br/><b>Description</b>: Deploy a 64u2011bit binary with a kernel driver encoded via substitution cipher."] class tech_obfuscated technique tech_masquerading["<b>Technique</b> – T1036 Masquerading<br/><b>Description</b>: Write driver as C:\ProgramData\OEM\Firmware\OemHwUpd.sys with OEMu2011like naming and timestamps."] class tech_masquerading technique tech_masquerade_filetype["<b>Technique</b> – T1036.008 Masquerading: Masquerade File Type<br/><b>Description</b>: Use .sys driver file type to appear as legitimate OEM component."] class tech_masquerade_filetype technique tech_hide_artifacts["<b>Technique</b> – T1564 Hide Artifacts<br/><b>Description</b>: Set hidden/system attributes and perform timestomping."] class tech_hide_artifacts technique tech_hide_path["<b>Technique</b> – T1564.012 Hide Artifacts: File/Path Exclusions<br/><b>Description</b>: Place driver in obscure ProgramData path to avoid scanning."] class tech_hide_path technique tech_hijack_service["<b>Technique</b> – T1574.010 Hijack Execution Flow: Services File Permissions Weakness<br/><b>Description</b>: Create Windows kernel service OemHwUpd to load malicious driver."] class tech_hijack_service technique tech_priv_esc["<b>Technique</b> – T1068 Exploitation for Privilege Escalation<br/><b>Description</b>: Use signed but revoked EnCase forensic driver to gain kernelu2011mode execution."] class tech_priv_esc technique tech_impair_defenses["<b>Technique</b> – T1562 Impair Defenses<br/><b>Description</b>: Driver provides IOCTL to terminate security processes from kernel mode."] class tech_impair_defenses technique tech_service_stop["<b>Technique</b> – T1489 Service Stop<br/><b>Description</b>: Terminates targeted security services continuously."] class tech_service_stop technique tech_subvert_trust["<b>Technique</b> – T1553 Subvert Trust Controls<br/><b>Description</b>: Exploit lack of certificate revocation checking to load expired, revoked driver signature."] class tech_subvert_trust technique tech_system_services["<b>Technique</b> – T1569 System Services<br/><b>Description</b>: Register driver as demandu2011start kernel service for persistence."] class tech_system_services technique tech_active_scanning["<b>Technique</b> – T1595 Active Scanning<br/><b>Description</b>: Highu2011rate SYN flooding and port scans observed."] class tech_active_scanning technique tech_ipblock_scanning["<b>Technique</b> – T1595.001 Active Scanning: Scanning IP Blocks<br/><b>Description</b>: Scanning of internal IP ranges observed."] class tech_ipblock_scanning technique %% Connections u2013 Attack Flow artifact_credentials –>|enables authentication| tech_valid_accounts tech_valid_accounts –>|gains foothold via VPN| tech_remote_discovery tech_remote_discovery –>|collects| artifact_network_recon tech_remote_discovery –>|leads to deployment of| tech_obfuscated tech_obfuscated –>|drops| artifact_obfuscated_binary artifact_obfuscated_binary –>|contains| artifact_driver_file artifact_driver_file –>|subject to| tech_masquerading artifact_driver_file –>|subject to| tech_masquerade_filetype artifact_driver_file –>|subject to| tech_hide_artifacts artifact_driver_file –>|subject to| tech_hide_path tech_masquerading –>|enables creation of| tech_hijack_service tech_hijack_service –>|creates| artifact_service tech_hijack_service –>|facilitates| tech_priv_esc tech_priv_esc –>|uses| artifact_revoked_driver tech_priv_esc –>|enables| tech_impair_defenses tech_impair_defenses –>|supports| tech_service_stop tech_impair_defenses –>|supports| tech_subvert_trust tech_subvert_trust –>|facilitates| tech_system_services tech_system_services –>|maintains persistence via| artifact_service tech_system_services –>|related to| tech_active_scanning tech_active_scanning –>|includes| tech_ipblock_scanning "

Attack Flow

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

  • Attack Narrative & Commands:

    The adversary, having obtained valid domain credentials (T1078) and remote access via EnCase (T1133), copies a malicious kernel driver (OemHwUpd.sys) into the OEM firmware directory on the target host. The driver is signed with a forged certificate to bypass driver signature enforcement. The attacker then registers and starts the driver using sc.exe, causing the kernel to load the driver. This action produces a Sysmon Image Load event where the Image field ends with OEMFirmwareOemHwUpd.sys, directly matching the Sigma rule.

    Steps:

    1. Stage the malicious driver on the attack machine.
    2. Copy the driver to C:OEMFirmwareOemHwUpd.sys on the target host via the EnCase remote session.
    3. Create a kernel‑service entry pointing to the malicious driver.
    4. Start the service to force the kernel to load the driver.

  • Regression Test Script:

    # -------------------------------------------------
# EDR Killer Driver Deployment Simulation (PowerShell)
# -------------------------------------------------
# Variables
$maliciousDriverSource = "C:TempOemHwUpd.sys"   # Path on attacker machine (pre‑staged)
$targetDriverPath      = "$env:SystemRootOEMFirmwareOemHwUpd.sys"
$serviceName           = "EDRKiller"

# 1. Copy malicious driver to the target OEM directory
Write-Host "[*] Copying malicious driver to $targetDriverPath"
Copy-Item -Path $maliciousDriverSource -Destination $targetDriverPath -Force

# 2. Create a kernel service pointing to the driver
Write-Host "[*] Creating kernel service $serviceName"
$createCmd = "sc.exe create $serviceName binPath= `"$targetDriverPath`" type= kernel"
iex $createCmd

# 3. Start the service to load the driver
Write-Host "[*] Starting service $serviceName (driver load)"
sc.exe start $serviceName | Out-Null

# 4. Optional: pause to allow SIEM ingestion
Start-Sleep -Seconds 10

Write-Host "[+] Simulation complete. Verify detection in SIEM."
# -------------------------------------------------

  • Cleanup Commands:

    # -------------------------------------------------
# Cleanup for EDR Killer Driver Simulation
# -------------------------------------------------
$serviceName = "EDRKiller"
$targetDriverPath = "$env:SystemRootOEMFirmwareOemHwUpd.sys"

# Stop and delete the kernel service
Write-Host "[*] Stopping service $serviceName"
sc.exe stop $serviceName | Out-Null
Write-Host "[*] Deleting service $serviceName"
sc.exe delete $serviceName | Out-Null

# Remove the malicious driver file
Write-Host "[*] Deleting driver file $targetDriverPath"
Remove-Item -Path $targetDriverPath -Force -ErrorAction SilentlyContinue

Write-Host "[+] Cleanup complete."
# -------------------------------------------------

Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.

Join for Free