Full Report
Uncover how BYOVD attacks exploit signing trust over disposable drivers, and why enforcing certificate revocation is essential for modern endpoint defense.
Analysis Summary
# Tool/Technique: Bring Your Own Vulnerable Driver (BYOVD)
## Overview
BYOVD is a post-exploitation technique where an attacker with administrative privileges installs a legitimate but vulnerable kernel-mode driver on a target system. By exploiting a known vulnerability within the trusted driver, the attacker executes malicious code with kernel-level (Ring 0) privileges. This allows them to bypass security controls, terminate endpoint detection and response (EDR) agents, and achieve deep persistence.
## Technical Details
- **Type:** Technique
- **Platform:** Windows (primarily)
- **Capabilities:** Kernel-level code execution, EDR termination/silencing, memory tampering, and bypassing Windows Driver Signature Enforcement (DSE).
- **First Seen:** Historically leveraged for years; notable surge in "EDR Killer" tool development documented in 2025-2026.
## MITRE ATT&CK Mapping
- **TA0005 - Defense Evasion**
- **T1543.003 - Create or Modify System Process: Windows Service** (Used to load the driver)
- **T1068 - Exploitation for Privilege Escalation** (Exploiting the driver to reach Ring 0)
- **T1562.001 - Impair Defenses: Disable or Modify Tools** (Using kernel access to kill EDR/AV)
- **T1027 - Obfuscated Files or Information** (Backdating signatures to bypass DSE)
## Functionality
### Core Capabilities
- **Signature Exploitation:** Leverages the "Trust Gap" where the Windows kernel loads drivers signed with expired or revoked certificates, provided they chain to a cross-signed authority or are backdated.
- **Privilege Escalation:** Moves execution from User Mode (Admin) to Kernel Mode.
- **EDR Killing:** Directly tampering with EDR process handles, callbacks, or memory to disable security monitoring.
### Advanced Features
- **Signature Timestamp Forgery:** Forging metadata to make a signature appear to predate the July 29, 2015, cross-signing cutoff, effectively re-validating revoked keys.
- **Disposable Wrapper Strategy:** Attackers recompile drivers to change file hashes (bypassing hash-based blocklists) while reusing the same scarce, stolen signing keys.
- **Persistence:** Installing the vulnerable driver as a service to ensure kernel access survives reboots.
## Indicators of Compromise
- **File Hashes:** Associated with older forensic tools (e.g., EnCase), overclocking utilities, or hardware diagnostic drivers. (Specific hashes vary due to frequent recompilation).
- **File Names:** Often disguised as legitimate system utilities or hidden in temp directories.
- **Registry Keys:** `HKLM\SYSTEM\CurrentControlSet\Services\[DriverName]` (Creation of new services for driver loading).
- **Network Indicators:** None (Local execution technique).
- **Behavioral Indicators:**
- Loading of drivers from the **LOLDrivers** catalog.
- Process termination of EDR/AV binaries from a kernel-level source.
- Unauthorized calls to `NtLoadDriver` or `ZwLoadDriver`.
## Associated Threat Actors
- **Ransomware Groups:** Qilin, BlackCat/ALPHV, and various "EDR Killer" developers.
- **State-Sponsored Actors:** Historically used for advanced persistence.
- **Cyber Mercenaries:** Groups using leaked kits (e.g., Hacking Team leaks).
## Detection Methods
- **Signature-based detection:** Monitoring for known vulnerable driver hashes (LOLDrivers project).
- **Behavioral detection:**
- Monitoring for **Sysmon Event ID 6** (Driver Loaded) especially for drivers with old/expired timestamps.
- Detecting the modification of EDR process objects in memory.
- **YARA rules:** Targeting drivers containing known vulnerable IOCTL (Input/Output Control) codes.
## Mitigation Strategies
- **Enforce Driver Blocklists:** Enable the Microsoft Vulnerable Driver Blocklist and supplement with community lists like LOLDrivers.
- **HVCI/VBS:** Enable Hypervisor-Protected Code Integrity (HVCI) and Virtualization-Based Security (VBS) to prevent unsigned or non-compliant drivers from loading.
- **Revocation Enforcement:** Implement strict certificate revocation checks for kernel drivers.
- **Least Privilege:** Restrict administrative rights to prevent the initial loading of the driver service.
## Related Tools/Techniques
- **LOLDrivers:** A community project cataloging vulnerable drivers.
- **EDR Killers:** Specialized tools designed specifically to automate the BYOVD process against security software.
- **Backdating/Timestomping:** Techniques used to manipulate file metadata to bypass temporal security policies.