Cybersecurity researchers are warning about a growing wave of attacks that exploit legitimate Windows drivers to bypass security protections and gain deep control over targeted systems.
The technique, known as Bring Your Own Vulnerable Driver or BYOVD, involves attackers loading digitally signed but flawed drivers onto a compromised machine. Once active, the vulnerable driver can be exploited to gain kernel level privileges, the highest level of access in the Windows operating system.
Researchers from Picus Security said the method allows threat actors to “load a legitimate, digitally signed, but vulnerable driver onto a target system” and then exploit weaknesses in that driver to gain arbitrary kernel mode execution.
With this level of access, attackers can disable endpoint security tools, manipulate operating system processes and carry out further malicious activity without interference.
How the attack works
BYOVD attacks do not provide the initial entry point into a system. Instead, attackers use the technique after gaining administrative access through other methods such as phishing campaigns, stolen credentials, exploitation of exposed services or purchasing access from an initial access broker.
Once administrative privileges are obtained, attackers introduce a vulnerable driver file into the system. The driver, typically a .sys file, is often placed in directories that allow easy writing access such as temporary Windows folders or public user directories.
Many of these drivers are taken directly from legitimate vendor software packages, including hardware utilities, monitoring tools or gaming applications. Because the drivers are officially signed and appear legitimate, they can pass Windows trust checks.
Attackers then load the driver into the Windows kernel.
This is commonly done through the Windows Service Control Manager using commands such as sc.exe create and sc.exe start, or by calling system level APIs like NtLoadDriver.
Since the driver carries a valid digital signature, Windows allows it to run in kernel space without immediately triggering alerts.
Exploiting driver weaknesses
After the vulnerable driver is loaded, attackers exploit unsafe input and output control functions exposed by the driver. These functions can allow direct reading and writing of system memory.
By sending specially crafted requests, attackers can gain access to protected kernel memory regions. This effectively provides full control over the operating system’s most privileged layer.
With kernel read and write capabilities, attackers can disable security protections in several ways. They may remove endpoint detection and response callbacks from kernel structures, patch tamper protection routines in memory, terminate antivirus processes or manipulate system process objects to conceal malicious activity.
Even though security software may still appear installed, the endpoint may effectively be left unprotected.
Example of driver abuse
One attack analyzed by Picus researchers involved ransomware actors exploiting the mhyprot2.sys anti cheat driver used by the popular video game Genshin Impact.
In that case, attackers installed the legitimate driver and then used a separate executable to send a specific command instructing the driver to terminate antivirus processes.
Because the driver operated with kernel level privileges, it successfully executed system level commands to kill security services.
Once defenses were disabled, ransomware encryption was deployed without resistance.
Structural weaknesses in driver trust
The effectiveness of BYOVD attacks stems partly from how Windows manages driver trust. Since Windows 10, most new kernel drivers must be signed through Microsoft’s developer portal.
However, compatibility requirements allow certain older cross signed drivers to still load under specific conditions.
These conditions include systems where Secure Boot is disabled or devices that were upgraded from older Windows installations rather than freshly installed.
Such compatibility allowances create gaps that attackers can exploit by loading vulnerable legacy drivers that remain trusted by the system.
Microsoft also maintains a vulnerable driver blocklist, but this list is updated only after vulnerabilities are discovered and reported. Updates often coincide with major Windows releases, meaning newly identified vulnerable drivers may remain usable for extended periods.
As a result, BYOVD attacks do not technically bypass Windows security mechanisms. Instead, they take advantage of drivers that the operating system still considers trustworthy.
Defending against BYOVD
Security experts say defending against this technique requires layered protections rather than a single configuration change.
Organizations are advised to enable hypervisor protected code integrity and the broader virtualization based security framework to prevent unauthorized kernel memory changes.
Controls such as Windows Defender Application Control and Microsoft’s vulnerable driver blocklist can restrict which drivers are allowed to run.
Limiting administrative privileges is another critical step.
Companies should remove unnecessary local administrator rights, enforce least privilege policies and require multi factor authentication for privileged accounts.
Monitoring for suspicious activity is also essential.
Security teams should watch for unusual driver loading events or new kernel service creation logs.
Maintaining Secure Boot and restricting driver installation through group policy can further reduce the risk of unauthorized or legacy drivers being loaded.
Regular auditing of third party drivers installed on systems can help reduce the overall kernel attack surface.
Security analysts say BYOVD reflects a broader change in attacker strategy. Instead of relying only on new vulnerabilities or zero day exploits, threat actors increasingly use trusted components that already exist within systems.
