Bring Your Own Vulnerable Driver (BYOVD)

How attackers exploit legitimately signed but vulnerable drivers to achieve kernel-level privileges, bypass security controls, and maintain persistent access. Understanding BYOVD attacks and implementing effective defenses.

Description

Bring Your Own Vulnerable Driver (BYOVD) is a sophisticated attack technique where adversaries introduce legitimately signed but vulnerable drivers into a target system to exploit their inherent security flaws. Since device drivers operate at the kernel level (Ring 0) of the operating system, they possess elevated privileges and direct access to critical system resources, hardware, and memory.

The attack leverages the operating system's inherent trust in code-signed drivers from legitimate vendors. Attackers exploit known vulnerabilities in these drivers to escalate privileges to kernel level, effectively bypassing traditional security measures including Endpoint Detection and Response (EDR) solutions, antivirus software, and Windows Defender.

This technique is particularly insidious because:

The drivers are legitimately signed by trusted certificate authorities
They appear as trusted system components to security software
They provide unrestricted kernel access once loaded
They can disable or circumvent most security controls

BYOVD attacks have been observed in high-profile campaigns, including those conducted by Advanced Persistent Threat (APT) groups and ransomware operators seeking to establish persistent access and evade detection.

Kernel-Level Threat

BYOVD attacks represent one of the most dangerous privilege escalation techniques because they provide attackers with the highest level of system access. Once successful, attackers can modify system behavior, disable security controls, and maintain persistent access that survives reboots and security scans.

Impact

Kernel-Level Privilege Escalation: Attackers gain Ring 0 access, the highest privilege level in Windows systems
Security Control Bypass: Ability to disable or circumvent EDR agents, antivirus software, and other security tools
Persistent Access: Installation of rootkits and other stealth mechanisms that survive system restarts
Memory Manipulation: Direct access to kernel memory, enabling credential harvesting and process manipulation
Driver Signature Enforcement Bypass: Ability to load unsigned or malicious drivers after gaining kernel access
System Integrity Compromise: Modification of critical system components and security policies
Lateral Movement Facilitation: Enhanced capabilities for moving through networks undetected
Data Exfiltration: Unrestricted access to sensitive system and user data

The kernel-level access provided by BYOVD attacks makes them extremely dangerous for both individual systems and enterprise environments.

Common Vulnerable Drivers

Frequently Exploited Drivers

Process Hacker (procexp.sys): Microsoft Process Explorer driver with arbitrary read/write primitives
CPU-Z (cpuz.sys): Hardware monitoring driver with memory access vulnerabilities
MSI Afterburner (RTCore64.sys): Graphics card overclocking driver with I/O control flaws
ASUS GPU Tweak (ATSZIO.sys): GPU management driver with unrestricted memory access
Dell DBUtil (dbutil_2_3.sys): Dell BIOS utility driver with arbitrary write capabilities
Gigabyte GDRV (gdrv.sys): System management driver with kernel memory access
Intel Network Adapter (iqvw64e.sys): Network driver with privilege escalation vulnerabilities
NVIDIA Display Driver: Various versions with local privilege escalation flaws

Vulnerability Categories

Arbitrary Memory Read/Write: Drivers that allow unrestricted memory access
IOCTL Abuse: Improper validation of I/O control codes enabling privilege escalation
Buffer Overflows: Memory corruption vulnerabilities in driver code
Symbolic Link Attacks: Time-of-check-time-of-use (TOCTOU) vulnerabilities
Improper Access Control: Insufficient validation of caller privileges

Popular BYOVD Frameworks

EDRSandblast: Framework for bypassing EDR solutions using vulnerable drivers
KDU (Kernel Driver Utility): Tool for exploiting various vulnerable drivers
TDL (Turla Driver Loader): Sophisticated framework used by APT groups
Ghost: Rootkit framework leveraging BYOVD techniques

Detection

System-Level Monitoring

Driver Loading Events:
- Monitor Event ID 6 (driver loaded) in Microsoft-Windows-Kernel-Process-and-Thread/Analytic log
- Track new .sys files in System32\drivers\ directory
- Alert on drivers loaded from unusual locations

Sysmon Integration:

<!-- Sysmon Event ID 6: Driver loaded -->
<RuleGroup name="BYOVD Detection" groupRelation="or">
  <DriverLoad onmatch="include">
    <ImageLoaded condition="contains">procexp</ImageLoaded>
    <ImageLoaded condition="contains">cpuz</ImageLoaded>
    <ImageLoaded condition="contains">RTCore64</ImageLoaded>
  </DriverLoad>
</RuleGroup>

Registry Monitoring

Service Registration: Monitor HKLM\SYSTEM\CurrentControlSet\Services\ for new driver services
Driver Installation: Track changes to driver store locations
Certificate Validation: Monitor for drivers signed with compromised or revoked certificates

Memory Analysis

Live Analysis Tools:

# List loaded drivers
Get-WmiObject Win32_PnPSignedDriver | Select-Object DeviceName, DriverVersion, DriverDate
 
# Check for suspicious drivers
driverquery /v | findstr /i "vulnerable_driver_name"

Volatility Framework: Analyze memory dumps for indicators of BYOVD exploitation
WinAPIOverride: Monitor driver API calls for suspicious behavior

Behavioral Detection

EDR Evasion Indicators:
- Sudden loss of EDR telemetry
- Security process termination
- Unusual kernel-level API calls
Network Anomalies:
- Command and control communication after driver loading
- Data exfiltration patterns following privilege escalation

Remediation

Immediate Response Actions

Driver Blacklisting:

# Block specific vulnerable drivers using Group Policy
# Configure Windows Defender Application Control (WDAC) policies
New-CIPolicy -Level Publisher -FilePath "C:\temp\BYOVD-Block.xml" -UserPEs

Remove Vulnerable Drivers:
# Stop and remove vulnerable driver service sc stop vulnerable_driver_service sc delete vulnerable_driver_service del "C:\Windows\System32\drivers\vulnerable_driver.sys"
Revoke Driver Certificates: Contact certificate authorities to revoke certificates of known vulnerable drivers

Preventive Measures

Windows Defender Application Control (WDAC):

<!-- WDAC policy to block known vulnerable drivers -->
<Rules>
  <Rule>
    <Option>Enabled:Advanced Boot Options Menu</Option>
    <Option>Required:WHQL</Option>
    <Option>Enabled:Inherit Default Policy</Option>
  </Rule>
</Rules>

Driver Signature Enforcement:
# Enable strict driver signature enforcement bcdedit /set testsigning off bcdedit /set nointegritychecks off bcdedit /set loadoptions DISABLE_INTEGRITY_CHECKS
Vulnerable Driver Blocklist: Deploy Microsoft's recommended blocked driver list
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CI\Config] "VulnerableDriverBlocklistEnable"=dword:00000001

Enterprise Defense Strategy

Endpoint Protection:
- Deploy EDR solutions with kernel-level protection
- Implement application allowlisting for drivers
- Use memory protection features (Control Flow Guard, Intel CET)
Network Segmentation:
- Isolate critical systems from general network access
- Implement zero-trust network architecture
- Monitor east-west traffic for lateral movement
Access Controls:
- Restrict administrative privileges using Privileged Access Management (PAM)
- Implement just-in-time (JIT) administrative access
- Monitor and audit privileged account usage

Advanced Mitigations

Hypervisor-Based Protection:
- Enable Windows Defender System Guard
- Use virtualization-based security (VBS)
- Deploy Hypervisor-protected Code Integrity (HVCI)
Hardware Security Features:
- Enable Secure Boot and measured boot
- Use Trusted Platform Module (TPM) 2.0
- Implement Intel TXT or AMD SVM security features

Prevention

Organizational Policies

Driver Management Program:
- Maintain approved driver inventory
- Establish driver approval workflow
- Regular vulnerability assessments of approved drivers
Security Awareness Training:
- Educate IT staff about BYOVD risks
- Train incident response teams on BYOVD detection
- Conduct regular tabletop exercises

Technical Controls

Configuration Management:

# PowerShell DSC for driver management
Configuration SecureDriverConfig {
  Registry BlockVulnerableDrivers {
    Key = "HKLM:\SYSTEM\CurrentControlSet\Control\CI\Config"
    ValueName = "VulnerableDriverBlocklistEnable"
    ValueData = 1
    ValueType = "Dword"
  }
}

Group Policy Implementation:
- Configure driver installation restrictions
- Deploy security baselines for driver management
- Implement least-privilege principles

Monitoring and Alerting

SIEM Integration:
# SIEM rule for BYOVD detection rule: BYOVD_Driver_Load condition: - event_id: 6 - image_loaded contains: ["procexp", "cpuz", "RTCore64"] action: alert_high_priority
Threat Hunting:
- Regular searches for known vulnerable driver signatures
- Behavioral analysis of kernel-level activities
- Correlation of driver loading with subsequent malicious activities

Verification

System Hardening Validation

Driver Inventory Audit:
# Comprehensive driver enumeration Get-WindowsDriver -Online | Where-Object {$_.ProviderName -notlike "*Microsoft*"} | Select-Object Driver, ProviderName, Date, Version
Policy Compliance Check:
# Verify WDAC policy enforcement Get-CIPolicy -FilePath "C:\Windows\System32\CodeIntegrity\SIPolicy.p7b"
Certificate Validation:
# Check driver certificate status signtool verify /pa /v "C:\Windows\System32\drivers\target_driver.sys"

Security Control Testing

Penetration Testing: Include BYOVD techniques in red team assessments
Purple Team Exercises: Simulate BYOVD attacks to test detection capabilities
Vulnerability Scanning: Regular scans for vulnerable drivers in the environment

Incident Response

Detection Phase

Initial Indicators:
- Unexpected driver loading events
- EDR agent communication loss
- Suspicious kernel-level process activity
Forensic Collection:
# Collect driver forensic artifacts Copy-Item "C:\Windows\System32\drivers\*.sys" "C:\Forensics\Drivers\" Get-EventLog -LogName System | Where-Object {$_.EventID -eq 6}

Containment Actions

Immediate Isolation:
- Network isolation of affected systems
- Disable vulnerable driver services
- Prevent lateral movement
Evidence Preservation:
- Memory dump collection
- Registry hive backups
- System file integrity verification

Recovery Procedures

System Remediation:
- Remove vulnerable drivers
- Rebuild compromised systems
- Validate system integrity
Security Enhancement:
- Deploy additional monitoring
- Update security policies
- Strengthen driver management controls

References

Next Steps

If BYOVD vulnerabilities or attacks are identified:

Immediately assess the scope of vulnerable driver deployment across the environment
Implement emergency containment measures to prevent further exploitation
Deploy comprehensive monitoring for kernel-level activities and driver loading
Consider related security concerns:
- PrintNightmare and other Windows privilege escalation vectors
- Endpoint security bypass techniques
- Advanced persistent threat (APT) detection and response

Takeaway: BYOVD attacks represent a critical threat to modern Windows environments by exploiting the trust relationship between operating systems and signed drivers. Organizations must implement comprehensive driver management, advanced monitoring, and defense-in-depth strategies to protect against these sophisticated kernel-level attacks. Make BYOVD prevention a core component of your security architecture.

Bring Your Own Vulnerable Driver (BYOVD)

On this page