Full Report
Discover how attackers leverage Windows Kernel loaders and abuse digitally signed drivers to gain privileged access, disable security tools, and stealthily maintain control — bypassing traditional defenses and enabling advanced threat operations.
Analysis Summary
# Tool/Technique: Bring Your Own Vulnerable Driver (BYOVD) & Kernel Loader Abuse
## Overview
This technique involves attackers leveraging legitimate, digitally signed Windows drivers that contain known vulnerabilities to gain kernel-mode execution. By loading these drivers, threat actors can bypass Windows Driver Signature Enforcement (DSE), disable security software (EDR/AV), and maintain high-privileged persistence within the Windows Kernel.
## Technical Details
- **Type:** Technique / Attack Framework
- **Platform:** Windows (x64)
- **Capabilities:** Kernel-level privilege escalation, security tool termination, memory tampering, and stealthy persistence.
- **First Seen:** Historically observed for years; recent escalations involve the abuse of Extended Validation (EV) certificates and Windows Hardware Compatibility Program (WHCP) accounts.
## MITRE ATT&CK Mapping
- **TA0004 - Privilege Escalation**
- **T1068 - Exploitation for Privilege Escalation**
- **TA0005 - Defense Evasion**
- **T1562.001 - Impair Defenses: Disable or Modify Tools**
- **T1027 - Obfuscated Files or Information**
- **TA0003 - Persistence**
- **T1547.006 - Boot or Logon Autostart Execution: Kernel Modules and Extensions**
## Functionality
### Core Capabilities
- **Driver Loading:** Utilizing loaders (e.g., KDU or custom variants) to drop and register vulnerable drivers.
- **DSE Bypass:** Disabling Driver Signature Enforcement to allow the execution of unsigned or malicious code in kernel space.
- **EDR/AV Neutralization:** Directly tampering with the memory of security agents or unregistering process notification callbacks to make the malware invisible to security tools.
### Advanced Features
- **EV Certificate Abuse:** Using stolen or fraudulently obtained Extended Validation certificates to sign malicious drivers, granting them high trust.
- **WHCP Exploitation:** Abusing the Windows Hardware Compatibility Program to obtain Microsoft-signed status for malicious code, making detection extremely difficult.
- **Manual Kernel Mapping:** Loading drivers into kernel memory without using standard Windows APIs to avoid creating registry artifacts.
## Indicators of Compromise
*Note: Due to the nature of BYOVD, hashes vary based on the specific vulnerable driver used (e.g., vulnerable versions of Capcom, MSI, or Gigabyte drivers).*
- **File Hashes (Common Loaders):**
- KDU variants: (Varies by build)
- **File Names:**
- `kdu.exe`
- `map.sys`
- `driver.sys` (generic)
- **Registry Keys:**
- `HKLM\SYSTEM\CurrentControlSet\Services\[RandomServiceName]`
- **Behavioral Indicators:**
- Sudden termination of EDR/AV service processes.
- Unexpected loading of known vulnerable drivers (e.g., `GDRV.sys`, `RTCore64.sys`).
- Use of `sc.exe` or `CreateService` API to load unusual drivers.
## Associated Threat Actors
- **Lazarus Group**
- **BlackByte Ransomware**
- **Scattered Spider**
- **Various APT and Ransomware-as-a-Service (RaaS) affiliates**
## Detection Methods
- **Signature-based detection:** Monitoring for known vulnerable driver hashes (see Microsoft's driver blocklist).
- **Behavioral detection:**
- Detecting unauthorized attempts to disable or modify system services.
- Monitoring for calls to `NtLoadDriver` originating from untrusted processes.
- **YARA Rules:** Target the headers and specific IOCTL (Input/Output Control) codes used by common vulnerable drivers to interact with the kernel.
## Mitigation Strategies
- **Microsoft Vulnerable Driver Blocklist:** Ensure the Windows "Vulnerable Driver Blocklist" is enabled and updated.
- **Hardware-Based Security:** Enable Hypervisor-Protected Code Integrity (HVCI) and Memory Integrity to prevent unauthorized kernel memory modifications.
- **Privilege Management:** Implement the principle of least privilege; restrict administrative rights to prevent the registration of new services/drivers.
- **Code Integrity Policies:** Utilize Windows Defender Application Control (WDAC) to restrict which drivers are permitted to load based on specific publisher attributes.
## Related Tools/Techniques
- **KDU (Kernel Driver Utility):** A popular tool for bypassing DSE and loading drivers.
- **Terminator / AuKill:** Specific tools used by threat actors to kill EDR processes via BYOVD.
- **Rootkits:** The logical evolution of successful kernel-mode access.