Loading malware…
Poortry, also known as BurntCigar, is a malicious Windows kernel-mode driver used to disable antivirus and endpoint detection and response (EDR) products. It is commonly deployed with Stonestop, a user-mode loader and controller that installs the driver and directs its operations through an IOCTL interface. Used after attackers obtain access to a system, the toolkit impairs endpoint defenses before subsequent malicious activity, particularly ransomware deployment.
Poortry can terminate, suspend, and resume selected processes. Later variants support file deletion and overwriting, allowing attackers to destroy essential security software components rather than merely stop their processes. This EDR-wiping functionality impedes recovery or restart of affected products. More advanced variants also neutralize security-related kernel callbacks and interfere with filter drivers and device stacks. Stonestop can direct deletion of targeted security files by name or file type.
Poortry abuses code-signing trust to load malicious code into the Windows kernel. Variants have used Microsoft attestation signing, stolen or leaked signing certificates, and forged signature timestamps. Operators have deployed differently signed versions in rapid succession to evade blocking. Poortry and Stonestop also use heavy packing and obfuscation, and some variants imitate legitimate driver metadata.
Poortry has been used by Scattered Spider, also tracked as UNC3944, and in attacks involving Cuba, BlackCat, Medusa, LockBit, and RansomHub ransomware. Its use spans multiple sectors, including telecommunications, business process outsourcing, and financial services. EDR-file destruction was observed during a July 2024 RansomHub intrusion.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Scattered Spider is known to exploit CVE-2015-2291 which is a vulnerability in the Intel Ethernet diagnostics driver for Windows (iqvw64.sys) that allows local users to cause a denial of service or possibly execute arbitrary code with kernel privileges... Scattered Spider exploited CVE-2015-2291 to deploy a malicious kernel driver in the Intel Ethernet diagnostics driver for Windows (iqvw64.sys). | Scattered Spider uses POORTRY and STONESTOP to terminate security software and evade detection. POORTRY is a malicious driver used to terminate selected processes on Windows systems, e.g., Endpoint Detection and Response (EDR) agent on an endpoint.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Scattered Spider uses POORTRY and STONESTOP to terminate security software and evade detection. POORTRY is a malicious driver used to terminate selected processes on Windows systems, e.g., Endpoint Detection and Response (EDR) agent on an endpoint.
"Scattered Spider uses POORTRY and STONESTOP to terminate security software and evade detection. POORTRY is a malicious driver used to terminate selected processes on Windows systems, e.g., Endpoint Detection and Response (EDR) agent on an endpoint."
The attackers used the known POORTRY driver... for the purposes of killing security software during this attack
22 distinct techniques documented for this family, organized by ATT&CK tactic.
CVE-2015-2291 ... allows local users to cause a denial of service or possibly execute arbitrary code with kernel privileges via a crafted ... IOCTL call.
Through a series of hooks to these low-level API calls inside the operating system, attackers can alter the signing process and bypass these checks to sign their own kernel driver. One of the functions being hooked in this technique is GetLocalTime to return a forged timestamp to pass through the checks in signtool.exe.
Through a series of hooks to these low-level API calls inside the operating system, attackers can alter the signing process and bypass these checks to sign their own kernel driver. One of the functions being hooked in this technique is GetLocalTime to return a forged timestamp.
When received, Poortry modifies the CmpCallbackCount variable to either enable or disable registry kernel callbacks. The variable is used to count the number of registered callbacks. We suspect that if this value is patched to zero, the callbacks will be rendered useless.
The threat actors also leverage known system vulnerabilities using “Bring Your Own Vulnerable Driver” (BYOVD) techniques to gain administrative privileges and evade detection from endpoint security products.
The binary is a 64-bit Windows PE driver named smuol.sys, and imitates a legitimate CrowdStrike Falcon driver.
Throughout 2022 and 2023, Poortry continued to evolve, optimizing its code and using obfuscation tools like VMProtect, Themida, and ASMGuard to pack the driver and its loader (Stonestop) for evasion.
Notably, it tries to masquerade by using the same information in its properties sheet as a driver (idmtdi.sys) for a commercially available software... the attackers merely cloned the information from it.
The latest report by Sophos is based on a RansomHub attack in July 2024 that employed Poortry to delete critical executable files (EXEs), dynamic link libraries (DLLs), and other essential components of security software.
Poortry now can also delete critical EDR components completely, instead of simply terminating their processes... The loader contains a list of hardcoded paths pointing at the location where EDR products are installed... and deletes files critical to the EDR agent, such as EXE files or DLL files.
The vulnerable drivers used by Scattered Spider are signed by stolen certificates from well-known authorities, such as Microsoft, NVIDIA, and Global Software LLC, which makes them appear legitimate.
SentinelOne has observed prominent threat actors abusing legitimately signed Microsoft drivers in active intrusions... a threat actor utilizing a Microsoft signed malicious driver to attempt evasion of multiple security products.
Scattered Spider typically exploits vulnerabilities such as CVE-2015-2291 and utilize tools like STONESTOP and POORTRY to terminate security software and evade detection.
Through a series of hooks to these low-level API calls inside the operating system, attackers can alter the signing process and bypass these checks to sign their own kernel driver. One of the functions being hooked in this technique is GetLocalTime to return a forged timestamp to pass through the checks in signtool.exe.
Through a series of hooks to these low-level API calls inside the operating system, attackers can alter the signing process and bypass these checks to sign their own kernel driver. One of the functions being hooked in this technique is GetLocalTime to return a forged timestamp.
When received, Poortry modifies the CmpCallbackCount variable to either enable or disable registry kernel callbacks. The variable is used to count the number of registered callbacks. We suspect that if this value is patched to zero, the callbacks will be rendered useless.
110 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
30 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A malicious Windows kernel driver used to terminate selected processes, particularly security and EDR software, to evade detection. It has been signed with a Microsoft Windows Hardware Compatibility Authenticode signature to help bypass trust controls.
A malicious Windows kernel driver used to kill selected processes, especially security and EDR software, to evade detection. The content notes it was signed with a Microsoft Windows Hardware Compatibility Authenticode signature.
Driver used in BYOVD attacks to disarm security tools in conjunction with the Osiris ransomware operation.
BYOVD-associated defense-evasion tool referenced as commonly used by ransomware groups to disable security products prior to encryption.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.