BYOVD — Bring Your Own Vulnerable Driver

TL;DR: Adversaries load a Microsoft-signed but vulnerable kernel driver (CVE-classified) to get arbitrary kernel R/W, then kill or blind EDR by patching its userland callbacks and unloading its minifilter. Lazarus’s RustDoor, Scattered Spider’s kdmapper chains, and BlackByte’s RTCore64.sys all use this primitive.

What it is

Kernel-mode drivers run at Ring 0 with full memory access. Microsoft requires drivers be code-signed, but old/legitimate signed drivers (with CVEs) remain installable. Once loaded, an attacker exploits the driver’s vulnerable IOCTL (e.g., arbitrary MSR write, arbitrary physical memory mapping) to gain kernel R/W, then walks EPROCESS / _PSP_CREATE_PROCESS_NOTIFY_ROUTINE arrays to nuke EDR.

Preconditions / where it applies

SeLoadDriverPrivilege (administrator) on the target
Driver Signature Enforcement still bypassed because the driver IS legitimately signed
HVCI (Hypervisor-protected Code Integrity) NOT enforced — HVCI is the main mitigation; on by default since Windows 11 22H2 on Secured-core PCs only
Microsoft Vulnerable Driver Blocklist NOT enabled or out of date (most enterprises before 2023)

Notable vulnerable drivers

Tradecraft

Stage the driver:

:: Copy signed .sys to target
copy RTCore64.sys C:\Windows\Temp\
:: Create service and start it
sc create rtcsvc binPath= C:\Windows\Temp\RTCore64.sys type= kernel
sc start rtcsvc

Open handle and issue exploit IOCTLs from userland loader:

  
HANDLE h = CreateFileW(L"\\\\.\\RTCore64", GENERIC_READ|GENERIC_WRITE, 0, NULL, OPEN_EXISTING, 0, NULL);
// Build RTCORE_MEMORY_READ struct, point to EPROCESS field
DeviceIoControl(h, IOCTL_RTCORE_MEMORY_READ, &in, sizeof(in), &out, sizeof(out), &br, NULL);

EDR blinding pattern:

Resolve EDR driver name (e.g., MsMpEng.exe for Defender, CSAgent.sys for CrowdStrike)
Walk PsLoadedModuleList to find its base
Patch PsSetCreateProcessNotifyRoutine, ObRegisterCallbacks, CmRegisterCallback slots — zero out EDR entries
Optionally unmap minifilter callbacks (FltRegisterFilter callback table)

Public tools:

EDRSandblast (wavestone-cdt) — automates BYOVD via RTCore64, supports kernel/userland unhook
Backstab (Yaxser) — terminates EDR via procexp152.sys
KDMapper (TheCruZ) — loads unsigned drivers via iqvw64e.sys (Intel)
Realblindingedr, EDRPrison, Terminator — variants in the wild

OPSEC tradeoffs:

Service creation (sc create … type= kernel) generates 7045 + 4697; some operators use NtLoadDriver direct syscall to skip SCM
Driver file on disk is a YARA goldmine (driver hashes are widely tracked); rename and reorder sections, or pack — but the signature won’t survive modification
Defender’s ASR rule “Block abuse of exploited vulnerable signed drivers” (BCDAB8E5-…) blocks the blocklist drivers in real time

Detection and defence

Enable Microsoft Vulnerable Driver Blocklist (default on Windows 11 since 22H2): DeviceGuard policy with HVCI + blocklist
HVCI prevents loading unsigned/altered drivers, and blocks read/write of executable kernel memory — kills most BYOVD R/W primitives
7045 service install where ImagePath ends in .sys and ServiceType = kernel from a non-admin process is a high-fidelity Sigma signal
Defender for Endpoint detects most blocklist drivers under “VulnerableDriverDetected”
Sysmon 6 (driver load) — alert on loads outside \Windows\System32\drivers\ and from temp paths
Hunt EDR connector silence: if EDR agent stops heartbeating but Windows service is still “running”, suspect kernel patching

References

LOLDrivers — community catalog of vulnerable signed drivers
Microsoft Vulnerable Driver Blocklist
EDRSandblast
Mandiant — Bring Your Own Vulnerable Driver — case studies