Threat Actor Defense Evasion: How Attackers Disable AV & EDR

What it is

A Huntress SOC blog cataloguing four ways attackers move past AV/EDR from evasion into active "impair/disable" — mapped to MITRE ATT&CK Defense Evasion, technique Impair Defenses (the page writes it "T.1652"). The goal it names is a "dark zone": telemetry silenced so the attacker can move laterally, exfiltrate, and deploy ransomware with no visibility.

How it works

The four techniques, at the detail the page gives:

• Silencing agent comms — two variants. Directly creating Windows Firewall rules (effective but noisy) vs. using the Windows Filtering Platform (WFP) to create hidden firewall rules. Either blocks the agent from reaching its platform; the agent keeps running locally, so it looks healthy while sending no telemetry. Named tools that abuse this: EDRSandblast and EDRSilencer.
• Uninstalling the agent — after (or without needing) privilege escalation, via Add/Remove Programs over RDP/screenshare, or from the command line. Noisy, but works when there's no real-time detection.
• Defender-specific abuse — adding Defender AV exclusions (the page shows excluding C: and C:\Windows) and firewall-rule abuse.
• BYOVD — the page calls this the "new gold standard." A legitimately signed but vulnerable driver is loaded into the kernel, then exploited to gain kernel-mode access and terminate protected processes an admin couldn't kill.

The two 2026 intrusion examples (EnCase 2006 driver, 59-process hit list, per-second kill loop; and the Huawei-audio-driver ScreenConnect malvertising campaign) are already in the summary.

What to do

The page offers no patches or commands. Its one concrete engineering takeaway is a detection philosophy: Huntress says its Managed EDR now detects BYOVD by watching for real-time abuse of a vulnerable driver while the adversary is hands-on-keyboard — not the after-effect (AV stopped, agent killed). The implication for defenders building detections: alerting on the impact is too late in a per-second kill loop; catch the driver load/abuse itself.

Also treat a healthy-but-silent agent as suspicious — WFP-hidden firewall rules produce exactly that state.

Caveats

This is a vendor post; the "what Huntress does" section is a product pitch and the fetched text cuts off mid-sentence there. No CVEs, driver versions, or IOCs are given for either real-world case — the summary's dates and process count are the extent of the specifics. The T.1652 identifier as written does not match the standard Impair Defenses ID format; verify against MITRE before citing.