EnCase

EnCase is a legitimate forensic toolset whose Windows kernel driver, EnPortv.sys, has been weaponized by threat actors as a bring-your-own-vulnerable-driver (BYOVD) EDR killer. Public reporting cited here describes attackers abusing a legitimate but revoked Guidance Software/EnCase driver to gain kernel-mode capability and terminate security processes, including in an intrusion where initial access was obtained via compromised SonicWall SSL VPN credentials. Huntress reported the driver’s signing certificate expired in 2010 and was later revoked, but Windows still loaded it, enabling attackers to disable security products from kernel mode. In the observed case, the attacker deployed a 64-bit executable disguised as a firmware update utility that embedded the EnCase driver and used a custom wordlist-based substitution cipher to conceal the driver as innocuous English text. The tool attempted to disable 59 security processes associated with major vendors including Microsoft, CrowdStrike, SentinelOne, Kaspersky, Sophos, and ESET. The reporting associates this tradecraft with ransomware-oriented intrusion activity, although the specific intrusion discussed was disrupted before ransomware deployment. High-confidence indicators and artifacts directly mentioned in the content include the driver name EnPortv.sys, use of compromised SonicWall SSL VPN credentials for initial access, and targeting of dozens of security-tool processes for termination.