# They Got In Through SonicWall. Then They Tried to Kill

Attackers used compromised SonicWall SSLVPN creds to breach a network, then deployed a BYOVD EDR killer abusing a revoked EnCase forensic driver to terminate 59 security processes from kernel mode.

- Payout: Real-world hack
- Severity: high
- Program: SonicWall SSLVPN
- Analysis by: Huntress
- Disclosed: 2026-02-04
- Write-up quality: 8/10
- Original: https://www.huntress.com/blog/encase-byovd-edr-killer
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-encase-byovd-edr-killer
- Tags: area:devices domain:network impact:integrity impact:privesc kind:incident platform:threat-intel sev:high tech:windows technique:reverse-engineering technique:source-review vuln:misconfiguration vuln:privilege-escalation

**Target:** SonicWall SSLVPN and Windows endpoint (kernel driver)
**Root cause:** Windows kernel Driver Signature Enforcement validates the cryptographic signature chain and timestamp but does not check certificate revocation or expiry, so a revoked 2006-era EnCase driver (EnPortv.sys) still loads. The driver exposes an IOCTL (0x223078 KillProc) that terminates arbitrary processes from kernel mode, bypassing PPL and EDR protections.
**Steps:**
1. Authenticate to SonicWall SSLVPN with compromised credentials from `69.10.60[.]250` (a denied portal login from `193.160.216[.]221` preceded it by one minute).
2. Conduct recon: ICMP ping sweeps, NetBIOS name probes, SMB SYN floods >370 SYNs/sec.
3. Drop masqueraded firmware-update binary (`svchost.exe`) that decodes an embedded wordlist-substitution-ciphered driver (256-word dictionary, index=byte; `block both choice about` -> `4D 5A 90 00`).
4. Write decoded driver to `C:\ProgramData\OEM\Firmware\OemHwUpd.sys`, set hidden+system attributes, timestomp from ntdll.dll.
5. Register kernel service `OemHwUpd` (Display: OEM Hardware HAL Service), Demand Start.
6. Enumerate processes via CreateToolhelp32Snapshot, lowercase names, FNV-1a hash (seed 0x811C9DC5), compare to 59 precomputed target hashes.
7. Open `\\.\OemHwUpd` and send target PIDs via `DeviceIoControl` IOCTL `0x223078`; driver calls ZwOpenProcess(PROCESS_TERMINATE)+ZwTerminateProcess from kernel mode.
8. Loop every 1 second to re-kill restarted security processes.
**How found:** Huntress correlated SonicWall SIEM telemetry with endpoint EDR: spotted a denied portal login one minute before a successful VPN client auth from a different IP, then analyzed the dropped binary's wordlist-encoded payload and driver IOCTL usage.
**Exploitation:** Initial access via valid SonicWall SSLVPN credentials lacking MFA. Attacker performed network recon, then executed a fake firmware updater that decodes and loads the revoked EnCase driver as a kernel service, using its KillProc IOCTL to terminate 59 EDR/AV processes from kernel mode (bypassing PPL). Attack was disrupted before ransomware deployment.
**Escalation:** Compromised VPN creds -> internal network access -> kernel-mode driver load -> termination of endpoint security to enable ransomware precursor activity.
**Insight:** When triaging EDR-killer malware, look for wordlist-substitution-encoded payloads (low ~4 bits/byte entropy, English-word blobs) that evade static and entropy detection; and check for kernel services mimicking OEM/HAL names created outside normal deployment. On the defensive side, DSE ignores CRL/expiry for pre-2015 timestamped drivers, so only Microsoft's hash blocklist or HVCI stops BYOVD.

## Proof of concept (copied exactly from the original report)

**Wordlist-encoded driver payload decoding to MZ header**

```
The first few words of the encoded payload demonstrate this transformation clearly: "block both choice about" decodes to “4D 5A 90 00”, the infamous MZ signature of a DOS executable header. This confirms the decoded output is a valid Windows PE file.
```

**Usermode sends target PID via IOCTL 0x223078**

```
The usermode component opens a handle to the driver's device (\\.\OemHwUpd) and sends target PIDs via DeviceIoControl. The driver, executing in kernel mode, calls ZwOpenProcess with PROCESS_TERMINATE access followed by ZwTerminateProcess.
```

**Kernel service registration for driver persistence**

```
Service Name: OemHwUpd

Display Name: OEM Hardware HAL Service

Description: Manages hardware abstraction layer compatibility

Binary Path: C:\ProgramData\OEM\Firmware\OemHwUpd.sys

Service Type: Kernel Driver

Start Type: Demand Start
```