Preventing EDR Termination using Vulnerable Drivers

A computer, comprising:

• a memory;
• and
• a processor configured:
• to deploy, in the memory, a hooked version of a syscall that is configured to modify an execution status of processes executing on the computer, the hooked version comprising injected program instructions configured to generate notifications in response to calls to the syscall;
• to specify one or more protected processes belonging to a security software application executing on the computer;
• to receive, from the hooked version of the syscall, a notification of a call by a driver to the syscall requesting to terminate an execution of one of the protected processes;
• and
• in response to the notification, to identify at least one process associated with loading and instructing the driver to call the syscall, and to inhibit execution of the syscall, the driver, and the at least one identified process.

A computer software product for protecting a computer, the computer software product comprising a non-transitory computer-readable medium in which program instructions are stored, which instructions, when read by a computer, cause the computer:

• to deploy, in the memory, a hooked version of a syscall that is configured to modify an execution status of processes executing on the computer, the hooked version comprising injected program instructions configured to generate notifications in response to calls to the syscall;
• to specify one or more protected processes belonging to a security software application executing on the computer;
• to receive, from the hooked version of the syscall, a notification of a call by a driver to the syscall requesting to terminate an execution of one of the protected processes;
• and
• in response to the notification, to identify at least one process associated with loading and instructing the driver to call the syscall, and to inhibit execution of the syscall, the driver, and the at least one identified process.