HACKERS ABUSE AVAST ANTI-ROOTKIT DRIVER TO DISABLE DEFENSES

Summary from the TLDR InfoSec newsletter

Trellix researchers have discovered a malware campaign that utilizes an old and vulnerable Avast anti-rootkit driver to evade detection. The malware drops the vulnerable driver in the default Windows user folder, then creates a service using sc.exe and registers the driver. The driver then leverages the DeviceIOControl API to terminate processes from a hardcoded list of 142 processes associated with various security solutions.