Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Play Ransomware – EDR-Killer Driver Drop Ahead of AD Recon

Play Defense Evasion Sentinel
MITRE ATT&CK
Service Stop
Data Source
DeviceFileEvents
Date Added
2026-07-23
Last Updated
2026-07-23
Source
ransomware.live group_tools dataset (play)
What This Detects
Play affiliates drop the 'EDRKill' BYOVD combo (echo_driver.sys + DBUtil 2.3) to stop security services, then run AdFind minutes later for AD enumeration. Correlates the two on the same host.
Query
let driverDrop = DeviceFileEvents
| where Timestamp > ago(1d)
| where FileName in~ ("echo_driver.sys","dbutildrv2.sys","dbutil_2_3.sys")
| project DeviceName, DropTime = Timestamp, DriverFile = FileName;
let adfindRun = DeviceProcessEvents
| where Timestamp > ago(1d)
| where FileName =~ "adfind.exe" or ProcessCommandLine has "AdFind"
| project DeviceName, AdFindTime = Timestamp, AdFindCmd = ProcessCommandLine;
driverDrop
| join kind=inner adfindRun on DeviceName
| where AdFindTime - DropTime between (0min .. 2h)
| project DeviceName, DropTime, DriverFile, AdFindTime, AdFindCmd

Hunting queries are starting points for threat hunting & detection engineering — validate table/column names against your own workspace schema and tune thresholds before turning any of these into a production alert rule.