Loading story…
Sophos said the Windows endpoint security industry still depends heavily on kernel drivers and DLL injection for core protections including anti-tampering, ransomware blocking, network inspection, zero-trust access, and process monitoring. The company tied that dependence to the fallout from the CrowdStrike kernel-driver incident, which crashed millions of Windows systems and prompted Microsoft to convene a Windows Endpoint Security Ecosystem Summit to discuss safer platform approaches.
Sophos said it uses gradual rollouts, feature flags, and other controlled deployment practices to limit the risk of low-level security components, but argued that Microsoft should add supported Windows APIs that let vendors perform key security functions without relying so extensively on kernel-mode code. The company pointed to needs across file, registry, process, network, driver-control, context-association, DLL-injection-equivalent, and tamper-protection capabilities, and cited Linux eBPF and fanotify as well as Apple’s move away from macOS kernel extensions as models for a safer long-term Windows security architecture.
See the reporting duties and controls this puts on the clock.
1 event from the most recent confirmed update back to the earliest known activity.
Microsoft convened the Windows Endpoint Security Ecosystem Summit after the CrowdStrike kernel-driver incident that crashed millions of Windows machines worldwide. Sophos said it participated in the summit and discussed how Windows could evolve to reduce reliance on third-party kernel drivers.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers and incident responders reported continued abuse of **Bring Your Own Vulnerable Driver (BYOVD)** techniques to disable endpoint protections, including **CrowdStrike Falcon**, by loading legitimately signed but flawed Windows kernel drivers. One newly analyzed zero-day driver family included more than 15 variants with valid Microsoft signatures and an IOCTL path such as `0x22E010` that accepted a process ID and invoked `ZwOpenProcess` and `ZwTerminateProcess` from kernel mode, allowing attackers to kill protected security processes without alerts. A proof-of-concept dubbed **PoisonKiller** demonstrated successful termination of the CrowdStrike EDR process through the driver’s symbolic link, underscoring the risk created by trusted but unrevoked third-party drivers. Separate reporting from Sophos and industry coverage tied the same broader tactic to real intrusions and ransomware activity, including ongoing abuse of **Terminator** and related tools built around vulnerable **Zemana** drivers. Attackers used IOCTL flaws to place their own processes on allow lists and then terminate AV and EDR components, while some incidents showed operators switching to alternatives such as **AuKill** when initial attempts failed. Defenders were urged to combine tamper protection, strict privilege controls, patching, and aggressive blocklisting of unnecessary vulnerable drivers, as signed-driver abuse has spread from advanced actors to commodity ransomware crews and lower-tier criminals.
Jun 30, 2026
Elastic Security Labs warned that ransomware operators increasingly use legitimately signed but vulnerable Windows drivers to gain kernel-mode execution, tamper with endpoint defenses, and encrypt systems. The researchers identified an unrestricted handle-duplication flaw in the Microsoft Sysinternals Process Explorer driver that a user-mode attacker could exploit to access raw physical memory, enabling arbitrary kernel read/write operations or kernel code execution. Organizations should treat vulnerable signed drivers as a high-risk attack path and block known-abused drivers before they load. Elastic recommends combining vulnerable-driver blocklists, Windows Defender Application Control (WDAC) driver allowlisting, behavioral protections, and monitoring for first-seen or anomalous driver loads; Elastic Endpoint 8.3 and later validates drivers against its blocklist prior to loading.
Aug 26, 2026
Fortinet disclosed two techniques that can let attackers load unsigned kernel drivers on Windows systems by tampering with **Driver Signature Enforcement (DSE)** at runtime, despite protections such as Code Integrity, PatchGuard, Virtualization-based Security, and Microsoft’s recommended vulnerable-driver block rules. The methods, dubbed **Page Swapping** and **Callback Swapping**, abuse kernel write access—often obtained through vulnerable third-party drivers—to redirect protected Code Integrity policy data or replace validation callbacks in `ntoskrnl.exe`, causing malicious drivers to be accepted as trusted. The report says Microsoft’s **Kernel Data Protection (KDP)** and driver blocklists raise the bar but do not fully stop runtime DSE tampering when **Hypervisor-protected Code Integrity (HVCI)** is not enabled, because driver validation can still be manipulated in the normal kernel. The findings build on a long history of DSE bypass tradecraft, including Turla-linked tooling such as **TDL**, a loader that mapped specially crafted unsigned drivers into kernel memory without modifying standard Code Integrity variables, underscoring how kernel-level access and vulnerable drivers remain a practical path to stealthy persistence and defense evasion on Windows.
Aug 15, 2026