EnCase Driver Weaponized as EDR Killers Persist

Threat actors gained access via compromised SonicWall VPN credentials and deployed a disguised 64-bit binary that embedded a revoked EnCase kernel driver to terminate EDR/antivirus processes (a BYOVD/EDR-killer technique). Huntress detected and disrupted the intrusion, analyzed the wordlist-obfuscated payload and recommended mitigations including enforcing MFA for VPNs, applying Microsoft-recommended driver block rules (WDAC), and enabling HVCI to enforce the Vulnerable Driver Blocklist.