Full Report
Discover how Bring Your Own Vulnerable Driver (BYOVD) tactics evolved from one-off hacker tools into a commercialized, tiered EDR-killer service economy.
Analysis Summary
# Tool/Technique: Bring Your Own Vulnerable Driver (BYOVD)
## Overview
BYOVD is a post-exploitation technique where attackers drop a legitimate, cryptographically signed—but known-vulnerable—third-party driver onto a target system. By exploiting the vulnerabilities within these trusted drivers (often buffer overflows or arbitrary memory writes), attackers gain kernel-level privileges (Ring 0). This allows them to bypass Windows Kernel Mode Code Signing (KMCS) and execute malicious actions, most notably the industrial-scale disabling or "killing" of Endpoint Detection and Response (EDR) and Antivirus (AV) agents.
## Technical Details
- **Type:** Technique (leveraging legitimate drivers as tools)
- **Platform:** Windows (Kernel Mode)
- **Capabilities:** Privilege escalation, EDR/AV service termination, blinding security sensors, kernel memory manipulation.
- **First Seen:** Early artifacts tracked to 2023 (Terminator); technique matured into commercial services by 2024-2026.
## MITRE ATT&CK Mapping
- **[TA0005 - Defense Evasion]**
- **[T1562.001 - Impair Defenses: Disable or Modify Tools]**
- **[T1027 - Obfuscated Files or Information]**
- **[TA0004 - Privilege Escalation]**
- **[T1068 - Exploitation for Privilege Escalation]**
- **[TA0003 - Persistence]**
- **[T1543.003 - Create or Modify System Process: Windows Service]**
## Functionality
### Core Capabilities
- **EDR Killing:** Terminating protected security processes that cannot be stopped via standard User Mode commands (e.g., `taskkill`).
- **Kernel Access:** Gaining Ring 0 execution by exploiting N-day vulnerabilities in signed drivers.
- **Bypassing PPL:** Removing Protected Process Light (PPL) protections from security software to allow process termination.
### Advanced Features
- **Commercialized Toolkits:** Transition from one-off scripts to versioned, maintained products (e.g., AvNeutralizer) sold on dark web forums.
- **Tiered Access:** Malware-as-a-Service (MaaS) providers offering specific EDR-killer modules only to high-level affiliates.
- **Driver Masquerading:** Using stolen or revoked certificates to sign malicious drivers that imitate legitimate security software.
- **Automation:** Integrating driver exploitation into automated ransomware deployment pipelines.
## Indicators of Compromise
- **File Names:**
- `Zemana.sys` (Abused by Terminator)
- `procexp.sys` (Process Explorer, abused by various)
- `RentDrv2`, `ThreatFireMonitor` (Used by EDRKillShifter)
- `rwdrv.sys` (ThrottleStop driver), `hlpdrv.sys` (Helper driver)
- **Behavioral Indicators:**
- Installation of unexpected kernel services/drivers by non-admin processes.
- Abrupt cessation of security agent heartbeats or logs.
- Use of `sc.exe` or `reg.exe` to create or modify services associated with known vulnerable drivers.
## Associated Threat Actors
- **FIN7** (Developers of AvNeutralizer/AuKill)
- **Black Basta**
- **LockBit**
- **RansomHub**
- **MedusaLocker**
- **Akira**
- **Qilin**
## Detection Methods
- **Signature-based detection:** Monitoring for known hashes of vulnerable drivers listed on projects like [LOLDrivers.io](https://www.loldrivers.io/).
- **Behavioral detection:**
- Identifying the "Load Driver" event followed immediately by attempts to access protected process memory.
- Monitoring for `SeLoadDriverPrivilege` abuse.
- **YARA rules:** Scanning for specific exploitation strings within suspected EDR-killer binaries.
## Mitigation Strategies
- **Microsoft Vulnerable Driver Blocklist:** Ensure the Windows driver blocklist is enabled and updated.
- **HVCI (Memory Integrity):** Enable Hypervisor-Protected Code Integrity (HVCI) to prevent unauthorized code execution in the kernel.
- **Attack Surface Reduction (ASR):** Implement rules to block the loading of specific signed drivers that are not required for business operations.
- **Least Privilege:** Restrict administrative rights to prevent the loading of new kernel services.
## Related Tools/Techniques
- **Terminator:** Commercial BYOVD tool by actor "Spyboy."
- **AvNeutralizer (AuKill):** FIN7-developed tool targeting EDR via Time Travel Debugging drivers.
- **EDRKillShifter:** A modular loader for various vulnerable drivers.
- **EDRSilencer / EDRSandblast:** Open-source tools/frameworks demonstrating EDR bypass techniques.
- **LOLDrivers:** The "Living off the Land" Drivers project documenting exploitable drivers.