# EDR killers explained: Beyond the drivers

DevFeed: [EDR killers explained: Beyond the drivers](<https://devfeed.tech/articles/edr-killers-explained-beyond-the-drivers-8361.md>)

Original publisher: [Read original article](<https://www.welivesecurity.com/en/eset-research/edr-killers-explained-beyond-the-drivers/>)

Author: Jakub Souček

Published: 2026-03-19T09:55:08Z

Content type: article

Language: en

Sources: [WeLiveSecurity](<https://devfeed.tech/sources/welivesecurity.md>)

Topics: [Endpoint Security & XDR](<https://devfeed.tech/topics/endpoint-security-xdr.md>), [ransomware](<https://devfeed.tech/topics/ransomware.md>), [Cybercrime](<https://devfeed.tech/topics/cybercrime.md>), [Encryption](<https://devfeed.tech/topics/encryption.md>), [telemetry](<https://devfeed.tech/topics/telemetry.md>), [1Password in the browser](<https://devfeed.tech/topics/1password-in-the-browser.md>)

Tags: [development](<https://devfeed.tech/tags/development.md>), [encryption](<https://devfeed.tech/tags/encryption.md>), [eset-research](<https://devfeed.tech/tags/eset-research.md>), [ransomware](<https://devfeed.tech/tags/ransomware.md>), [research](<https://devfeed.tech/tags/research.md>), [techniques](<https://devfeed.tech/tags/techniques.md>), [telemetry](<https://devfeed.tech/tags/telemetry.md>)

## AI overview

ESET researchers analyze nearly 90 EDR killers used in real ransomware intrusions, examining vulnerable-driver, anti-rootkit, script-based, and driverless approaches to disabling endpoint protection. The article explains how affiliates select and adapt these tools, why driver-based attribution can mislead, and how commercialized kits increase defense complexity.

## Source excerpt

ESET researchers dive deeper into the EDR killer ecosystem, disclosing how attackers abuse vulnerable drivers