Skip to main content
Meet us at Black Hat USA 2026— Las Vegas, August 1–6Book a Meeting
Mallory
Back to malware
MalwareRansomwareUsed by 3 actorsExploits 1 CVE

EDRSandBlast

EDRSandBlast is an open-source Windows EDR-killing / defense-evasion tool designed to disable or bypass endpoint security products at the kernel level. The provided content consistently describes it as using Bring Your Own Vulnerable Driver (BYOVD) techniques to tamper with Windows kernel structures, remove or disable kernel notification routines such as process-creation and image-load callbacks, and in some cases remove Protected Process Light protections. Multiple reports state that it resolves Windows kernel version/structure offsets and can use ntoskrnl.exe version information, embedded CSV offset data, or downloaded PDB symbols to support kernel manipulation across Windows versions.

The tool is repeatedly referenced as being customized by threat actors rather than only used in its public form. Kaspersky reporting states ToddyCat derived a 64-bit DLL tool named TCESB from EDRSandBlast, extending its functionality. In that activity, TCESB used DLL proxying via a malicious version.dll loaded by ESET Command-line Scanner (ecls) through insecure DLL search order behavior later assigned CVE-2024-11859. TCESB then used Dell DBUtilDrv2.sys, a vulnerable signed driver associated with CVE-2021-36276, to modify kernel structures and disable monitoring callbacks. That ToddyCat-derived variant also decrypted extensionless payload files with AES-128 and executed them from memory.

A separate intrusion tied to Qilin ransomware involved a customized EDRSandBlast variant delivered through DLL sideloading: a legitimate Carbon Black Cloud Sensor updater (upd.exe) loaded a malicious avupdate.dll, which decoded an XOR-encoded payload (web.dat) into the EDRSandBlast variant. In that case, the customized tool used the signed Toshiba TPwSav.sys driver instead of more commonly associated vulnerable drivers, abused its physical memory read/write capability, hijacked Beep.sys for arbitrary kernel memory access, and removed kernel callbacks and kernel event tracing to blind EDR products. Blackpoint assessed this activity occurred prior to attempted ransomware deployment.

The content also links EDRSandBlast to Russian SVR/APT29 exploitation of JetBrains TeamCity CVE-2023-42793, where operators reportedly exfiltrated ntoskrnl.exe to identify the system version before deploying EDRSandBlast via BYOVD to disable or kill EDR/AV and remove PPL protections. More broadly, Sophos reporting says EDRSandBlast was one of the most frequently observed EDR-killer tools in 2024, seen across MDR and incident response cases and in waves of attempted ransomware attacks, with a notable peak around the US Thanksgiving period.

High-confidence aliases and detections in the content include EDRSandBlast / EDRSandblast and Kaspersky detection HEUR:HackTool.Win64.EDRSandblast.a. The malware/tool is associated in the provided reporting with ToddyCat, Qilin ransomware intrusions, and SVR/APT29 post-exploitation activity. Targeting in the cited cases spans Windows enterprise environments, especially where attackers seek to neutralize endpoint defenses before credential theft, persistence, lateral movement, or ransomware execution.

Share:
For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES
CVE-2024-11859DLL Search Order Hijacking in ESET Command-line ScannerExploited in the wild

ESET registered the CVE-2024-11859 vulnerability, then on January 21, 2025 released an update for the ecls file patching the security issue.

via securelistsecurelist.com
THREAT ACTORS

Groups observed using it

3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details
ToddyCat

The search shows that most of them belong to the open-source malicious tool EDRSandBlast, designed to bypass security solutions. Kaspersky solutions detect it with the verdict HEUR : HackTool . Win64 . EDRSandblast . a . ToddyCat created the TCESB DLL on its basis, modifying the original code to extend the malware’s functionality.

via securelistsecurelist.com
SVR

“This was done using an open source project called ‘EDRSandBlast.’”

via cisa advisoriescisa.gov
APT29

“This was done using an open source project called ‘EDRSandBlast.’”

via cisa advisoriescisa.gov
MITRE ATT&CK

Techniques & procedures

10 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique
T1574Hijack Execution FlowEvidence1

In this case, the TA used these capabilities to overwrite the BeepDeviceControl function in the native Windows driver Beep.sys. The shellcode replacing this function implements a custom handler...

Persistence

1 technique
T1112Modify RegistryEvidence1

When these firewall rules are created, they’re actually stored in the registry under: HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\{GUID}... When filters are set, they’re stored in the registry just like firewall rules, just in a different location.

Privilege Escalation

1 technique
T1068Exploitation for Privilege EscalationEvidence2

the threat actor (TA) opted to use a driver named TPwSav.sys... making it an attractive choice for bypassing EDR protections through a bring-your-own-vulnerable-driver (BYOVD) attack.

Stealth

3 techniques
T1014RootkitEvidence1

“T1014: Rootkit” and tools/drivers listed (e.g., YDArk; vulnerable drivers used for BYOVD).

T1211Exploitation for Defense EvasionEvidence2

To modify the kernel structures that store callbacks used to notify applications of system events, TCESB deploys the Bring Your Own Vulnerable Driver (BYOVD) technique (Exploitation for Defense Evasion, T1211).

T1574Hijack Execution FlowEvidence1

In this case, the TA used these capabilities to overwrite the BeepDeviceControl function in the native Windows driver Beep.sys. The shellcode replacing this function implements a custom handler...

Defense Impairment

2 techniques
T1112Modify RegistryEvidence1

When these firewall rules are created, they’re actually stored in the registry under: HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\{GUID}... When filters are set, they’re stored in the registry just like firewall rules, just in a different location.

T1553Subvert Trust ControlsEvidence1

脆弱な署名済みドライバを武器化し ... Process Explorer(ProcExp)ドライバ(Microsoft署名済み)を悪用

Credential Access

1 technique
T1003.001LSASS MemoryEvidence1

EDRSandblast ... LSASS保護(RunAsPPL/Credential Guard)のバイパスとダンプ

Other

3 techniques
T1562Impair DefensesEvidence3

one of the most common ways to “blind” EDRs is to apply firewall rules against the desired EDR applications... although the EDR can collect telemetry of an action, those actions aren’t being sent up for detections or investigations.

T1562.001Disable or Modify ToolsEvidence1

taskkill、net stop、sc deleteなどの組み込みの管理ツールやコマンドを悪用して、セキュリティ製品のプロセスやサービスを改ざんします。

T1562.004Disable or Modify System FirewallEvidence1

The Windows Firewall has the ability to create custom rules that either allow or disallow an application to speak out through the network... as long as an attacker has local administrator rights they can successfully add an EDR agent into the firewall rule and block network connections.

INDICATORS OF COMPROMISE

IOCs tracked for this family

7 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app
Hashes
7 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting
hash.sha256●●●●●●●●●●●●View more in app1 year ago
hash.sha256●●●●●●●●●●●●View more in app1 year ago
hash.sha256●●●●●●●●●●●●View more in app1 year ago
hash.sha256●●●●●●●●●●●●View more in app2 years ago
hash.sha256●●●●●●●●●●●●View more in app3 years ago
hash.md5●●●●●●●●●●●●View more in app5 years ago
What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.
IOC matching7

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution3

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping10

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.