Signal Brief · Archived
Week of August 14, 2023
The Week's Public Record
Events
2023-08-16
research poc
AuKill EDR Killer Malware Technical AnalysisAuKill
A technical analysis of the AuKill malware, which uses a Bring Your Own Vulnerable Driver (BYOVD) technique with the PROCEXP.SYS driver to terminate protected EDR processes. The malware targets solutions like Sophos and Windows Defender, and has been used by ransomware groups including LockBit and Medusa.
Every event in this brief is a record in ColdRecon's canonical set, drawn from public open-source reporting and linked to its source. This is the general, non-personalized signal — published 7 days after the fact. The live daily brief, written for your deals, is for cleared officers.