Weaponizing Legitimate Low-Level Tools: How Ransomware Evades Antivirus Protections

Table of Contents

• Introduction
• The “Dual-Use Dilemma”: Why Attackers Prefer Legitimate Tools
• Why Antivirus Neutralization Matters
• Historical Evolution of Antivirus Neutralization
• The Ransomware Kill Chain
• Stages of Abusing Legitimate Low-Level Tools
  • Stage 1: Low-Level Tools for Antivirus Neutralization & Privilege Escalation
  • Stage 2: Credential Theft, Kernel Manipulation & Ransomware Deployment Tools
• Live Campaign Examples: From Antivirus Kill to Ransomware
• Threat Actor TTP Mapping (MITRE ATT&CK)
• Emerging Trends & Future Threats
• How Seqrite Protect Against These Activities
• Detection & Incident Response Recommendations for Advanced Threats
• Security Best Practices & Recommendations
• Conclusion

Introduction:

Ransomware isn’t just a piece of malicious code anymore — it’s run like a business. Modern attacks unfold in carefully planned stages, targeting everyone from home users to small businesses and large enterprises. Instead of relying only on custom malware, today’s adversaries act more like penetration testers with bad intentions: they study defences, look for weak spots, and then turn legitimate low-level tools against the very systems meant to be protected.

Take utilities like Process Hacker, IOBit Unlocker, PowerRun, or AuKill. These were originally created to help IT teams troubleshoot systems, manage the registry, or work with drivers. But in the wrong hands, they become weapons, used to silently shut down antivirus protections before ransomware ever shows its face.

Why attackers prefer them:

• Trust Factor: Because they’re digitally signed and commonly used, security systems often treat them as safe.
• Capability: They give attackers SYSTEM- or even kernel-level control, something regular malware often can’t achieve on its own.
• Stealth: Their activity looks like normal admin work, leaving very few traces behind.

This “dual-use dilemma” is exactly what makes them so dangerous — tools designed to fix problems can just as easily be turned into the perfect weapons for dismantling security, all without raising alarms.

Why Antivirus Neutralization Matters

Disabling antivirus isn’t just a minor step in a ransomware campaign—it’s a deliberate tactic to clear the way for payload execution. Security tools are built to block malicious files, record suspicious behavior, and alert defenders in real time. By shutting them down, attackers ensure their operations remain quiet and uninterrupted.

Here’s how disabling security measures directly benefits the attacker:

• Antivirus would block ransomware payloads at the moment of execution.
• EDR would capture and log abnormal file encryption behaviours.
• Forensic artifacts could give SOC teams a chance to respond.
• By disabling these protections, attackers create a silent zone where ransomware can run undetected.

Historical Evolution of Antivirus Neutralization

Ransomware groups haven’t just been standing still—they’ve been steadily refining how they bypass antivirus defences. What started as simple, script-based attacks has grown into highly sophisticated operations, including kernel-level manipulations and ready-made modules that now come standard in ransomware-as-a-service (RaaS) kits. The table below summarizes this progression:

Period	Primary Neutralization Technique	Representative Ransomware Families
2015 – 2017	Basic scripts (taskkill/net stop)	CryptoLocker, WannaCry
2018 – 2020	Process Hacker abuse	Ryuk, DoppelPaymer
2021 – 2023	Kernel-level driver manipulation	Conti, LockBit 2.0
2024 – Present	Prepackaged Antivirus killer modules in RaaS kits	LockBit 3.0, BlackCat

Over the years, attackers have moved from running simple commands to tampering directly with the operating system, and now they rely on automated RaaS kits that bundle antivirus neutralizers by default—making these attacks faster, stealthier, and harder to stop.

The Ransomware Kill Chain

Ransomware attacks typically follow a deliberate sequence of steps, often referred to as the kill chain, which takes an intrusion from initial compromise all the way to widespread encryption and operational disruption. When attackers use legitimate low-level tools, this chain becomes even stealthier and more efficient. Each stage is carefully crafted to bypass defences, gain higher privileges, and ensure the ransomware completes its mission undetected.

• Initial Access – Attackers gain entry through phishing emails, stolen credentials, or misused Remote Access Tools (RATs), establishing their first foothold.
• Privilege Escalation – Tools like PowerRun or YDArk are exploited to obtain SYSTEM- or kernel-level permissions.
• Antivirus Neutralization – Security software is disabled by stopping or unloading antivirus and EDR processes.
• Credential Theft – Utilities such as Mimikatz extract stored passwords and tokens to move laterally across the network.
• Persistence & Cleanup – Tools like Unlock_IT or Atool_ExperModel remove logs and disable startup routines to hide traces of the intrusion.
• Payload Execution – Finally, the ransomware is deployed, encrypting files while blending with normal system activity.

Stages of Abusing Legitimate Low-Level Tools

Adversaries typically follow a 2 stage process when abusing administrative and low-level utilities in ransomware campaigns. Each stage has a clear objective and leverages a distinct set of tools:

Stage 1: Low-Level Tools for Antivirus Neutralization & Privilege Escalation

Attackers often rely on a mix of file unlockers, process killers, privilege escalation utilities, and credential dumpers. By abusing these categories of legitimate tools, they systematically disable antivirus defences, erase traces, and prepare the environment for ransomware execution. The table below consolidates the most commonly abused tools into four major categories.

Tool	Legitimate Purpose	Attack Scenario (Malicious Use + Silent Command line Example + Technical Flow)	Security Impact
IOBit Unlocker	Unlock locked files	Deletes Antivirus binaries silently → IOBitUnlocker.exe /delete “C:\Program Files\AV\avp.exe” → Uses NtUnlockFile API to bypass OS locks	Prevents Antivirus from restarting or updating
TDSSKiller	Rootkit removal	Abused to unload Antivirus kernel drivers → tdsskiller.exe -silent -tdlfs → Blocks Antivirus kernel modules from reloading	Weakens kernel-level defence
Windows Kernel Explorer (WKE)	Kernel debugger	Direct driver unloading & kernel object manipulation via PsSetCreateProcessNotifyRoutine → attacker controls OS kernel	Grants full OS control
Atool_ExperModel	Registry/process diagnostic	Deletes Antivirus startup keys → atool.exe /regdel HKLM\SOFTWARE\AVVendor\Startup → Breaks persistence by removing scheduled tasks	Antivirus fails to auto-start after reboot
Process Hacker	Task manager/debugger	Terminates Antivirus processes via SeDebugPrivilege → taskkill /IM Antivirusguard.exe /F	Instantly shuts down real-time Antivirus monitoring
ProcessKO	Fast process termination	Terminates Antivirus services instantly → ProcessKO.exe -kill Antivirusservice.exe	Clears real-time protection in seconds

Stage 2: Credential Theft, Kernel Manipulation & Ransomware Deployment Tools

Once antivirus processes are neutralized, attackers pivot to stealing credentials, manipulating kernel-level defences, and executing ransomware payloads with elevated privileges. These tools are far more dangerous because they operate at the SYSTEM or kernel level, allowing adversaries to move laterally, disable security callbacks, and launch encryption payloads without interruption. The table below highlights the most commonly abused tools in this stage:

 

Tool	Legitimate Purpose	Attack Scenario (Malicious Use + Silent Command Line Example + Technical Flow)	Security Impact
0th3r_av5.exe	Admin utility disguise	Script-driven tool iterates over Antivirus services silently, bulk-kills processes simultaneously	Neutralizes multiple Antivirus agents at once
HRSword	Service/driver management utility (legitimate admin tool)	Manipulates service/driver state to disable Antivirus and prevent reinstallation → example silent command: HRSword.exe /service stop “avservice” /disable → stops target service, sets ServiceStart to disabled, and updates service binary path or recovery options to prevent automatic restart	Prevents Antivirus service recovery and reinstallation; extends attacker dwell time and hinders remediation
YDArk	Kernel manipulation	Disables Antivirus callbacks → ydark.exe -unload Antivirusdriver.sys → Hooks PsSetCreateThreadNotifyRoutine for stealth persistence	Undermines kernel protections
PowerRun	Run apps as SYSTEM	Executes ransomware payload at SYSTEM level → PowerRun.exe ransomware.exe	Bypasses user-level restrictions, full privilege
Unlock_IT	Unlock files/registry	Deletes Antivirus logs → UnlockIT.exe /unlock HKLM\Security\AVLogs → Erases registry entries and forensic traces	Breaks log-based investigation
HackTool AuKill	Antivirus neutralizer	Explicitly kills Antivirus/EDR processes → Antiviruskiller.exe –kill –all	Creates blind spot for ransomware deployment
Mimikatz	Credential dump tool	Extracts cached admin creds → mimikatz.exe privilege::debug sekurlsa::logonpasswords → Reads LSASS memory	Enables lateral spread via stolen credentials

Live Campaign Examples: From Antivirus Kill to Ransomware:

Ransomware operators often rely on legitimate low-level system utilities to neutralize Antivirus protections, escalate privileges, and create the perfect environment for payload execution. Below is a consolidated view of widely abused tools and the ransomware campaigns where they have been observed:

 

Tool	Associated Ransomware Campaigns
IOBit Unlocker	LockBit Black 3.0, Weaxor, TRINITY, Proton / Shinra, Mimic, Makop, Dharma, Mallox, Phobos
Process Hacker	Phobos, Makop, Dharma, GlobeImposter 2.0
Windows Kernel Explorer (WKE)	Dharma (.cezar Family), TRINITY, MedusaLocker
HRSword	Phobos, GlobeImposter 2.0, Makop
YDArk	Weaxor, Phobos
TDSSKiller	BlackBit
Atool (Atool_ExperModel)	Trigona
ProcessKO	Makop
0th3r_av5.exe	MedusaLocker
Unlock_IT	TargetCompany
Mimikatz	INC Ransomware

 

Threat Actor TTP Mapping (MITRE ATT&CK)

Every ransomware campaign follows a pattern, and attackers rarely act randomly. They carefully select tools and techniques that align with their objectives at each stage of the attack. By mapping these actions to the MITRE ATT&CK framework, we can better understand how legitimate low-level utilities are repurposed for malicious use.

The table below shows how adversaries move from privilege escalation to disabling defences, stealing credentials, and finally executing their ransomware payload — all while abusing trusted tools that were never designed for crime. This mapping makes it easier for defenders to visualize the attacker’s playbook and identify opportunities to detect or disrupt the intrusion before damage is done.

 

Stage	Technique	MITRE ATT&CK Sub-Technique ID	Tools Involved	Activities
Privilege Escalation	Abuse Elevation Control Mechanism	T1548.002	PowerRun, WKE, YDArk	SYSTEM/kernel access
Defence Evasion	Disable Security Tools	T1562.001	AuKill, IOBit Unlocker, ProcessKO, Process Hacker	Bypass Antivirus/EDR
Credential Access	OS Credential Dumping	T1003.001	Mimikatz	Lateral movement
Persistence	Modify Registry	T1112	Unlock_IT, Atool_ExperModel	Maintain Antivirus-disabled state
Defence Evasion	File Deletion / Log Cleaning	T1070.004	Unlock_IT	Removes forensic evidence
Discovery	System Service Discovery	T1082	Process Hacker, PowerRun	Identify running Antivirus processes
Impact	Inhibit System Recovery	T1490	ProcessKO, Unlock_IT	Blocks recovery options
Impact	Data Encrypted for Impact	T1486	All tools	Prepares ransomware payload

Emerging Trends & Future Threats

Ransomware is becoming faster, smarter, and harder to detect. Key emerging trends include:

• RaaS Antivirus Killers – Prebuilt scripts in ransomware kits designed to disable antivirus defences automatically.
• Kernel-Level Escalation – Attackers exploit drivers to gain stealthy, high-level control over systems.
• Multi-tool Chains – Utilities like PowerRun, Unlock_IT, and AuKill are combined to bypass security layers reliably.
• AI-Assisted Techniques – AI helps automatically select the most effective neutralization method for each environment.
• Supply Chain Attacks – Trojanized administrative tools and fake software updates create new infection vectors.
• Cloud Endpoint Targeting – Hybrid cloud infrastructures and their security tools are increasingly vulnerable to sophisticated attacks.

These trends indicate that ransomware is evolving toward more automated, precise, and evasive operations, making proactive defence strategies essential.

How Seqrite Protect Against These Activities

Seqrite offer layered defences to counter sophisticated ransomware and Antivirus-neutralization tactics through Seqrte EPP:

• Virus Protection – Identifies and blocks trojanized installers, malicious scripts, and ransomware payloads before they can execute.
• Antivirus Self Protection – Prevents attackers from forcibly terminating or uninstalling Antivirus software.
• Behavioural Detection – Monitors for suspicious actions such as mass process termination, registry tampering.
• Ransomware Protection – Detects abnormal file encryption activity in real time, stopping ransomware before it spreads
• Application Control – Restricts execution of unapproved utilities and administrative tools to prevent misuse. Together, these features provide proactive and reactive protection, keeping endpoints safe even against advanced, multi-stage attacks.

We continuously monitor the threat landscape and proactively hunt for new or modified variants of abused utilities, rapidly updating our detection modules and behavior rules to maintain effective coverage.

Detection & Incident Response Recommendations for Advanced Threats

Protecting against modern ransomware requires proactive monitoring and structured response strategies:

• Process Termination Monitoring – Detect suspicious mass termination of antivirus or EDR processes.
• Registry & File Auditing – Track changes to Antivirus-related registry keys, logs, and startup entries.
• Behavioural Analysis – Identify unusual SYSTEM-level execution and kernel-level modifications.
• Credential Theft Detection – Monitor access patterns to LSASS and other credential stores.
• Application Control – Limit execution to whitelisted administrative tools to prevent misuse.
• Playbooks & Alerts – Automate alerts for attack sequences such as privilege escalation → Antivirus termination → registry/log changes → ransomware execution.
• Endpoint Isolation – Rapidly isolate affected devices to contain the threat and prevent lateral movement.

These steps help organizations detect sophisticated attacks early and respond in a structured, timely manner, reducing the risk of full-scale disruption.

Security Best Practices & Recommendations

Implementing proactive security measures can greatly reduce the risk of ransomware and advanced attacks:

• Enforce MFA for Administrators – Require multi-factor authentication to protect privileged accounts from compromise.
• Enable Application Whitelisting – Block unapproved or unverified binaries, stopping malicious tools before they can execute.
• Monitor Termination Events – Continuously detect and alert on suspicious commands like sc stop, net stop, or taskkill.
• Restrict Low-Level Tool Usage – Limit execution to vetted, business-critical administrative tools only.
• Audit Registry Changes – Track and flag modifications to registry keys associated with Antivirus, EDR, or startup configurations.
• Educate SOC Teams – Train security analysts to spot subtle attempts to bypass or neutralize defences.
• Isolate Administrative Utilities – Provide access to sensitive tools only via secure, monitored jump boxes.

Following these best practices ensures that organizations maintain strong control over critical systems, detect suspicious activity early, and minimize the impact of potential attacks.

Conclusion

Low-level administrative tools, originally designed to make IT operations more efficient, have increasingly been weaponized in ransomware campaigns. Attackers exploit them to disable antivirus and EDR defences, maintain stealthy persistence, and prepare systems for silent, large-scale encryption. What were once trusted utilities have now become some of the most dangerous enablers of cyberattacks.

The key takeaway is clear: dual-use tools represent a serious risk to enterprise security. Combating this threat requires layered defences that combine the strength of Quick Heal / Seqrite protection with strict governance and control over administrative utilities. By reclaiming these tools as trusted allies of defenders rather than weapons for attackers, organizations can deny adversaries their stealth advantage and safeguard critical infrastructure against modern ransomware campaigns.

We continuously monitor the threat landscape, proactively hunt for new or modified tool variants, and feed those discoveries directly into our detection modules — ensuring our coverage evolves as attackers change tactics.