Signed Windows Drivers Used for Kernel-Level Defense Evasion and Backdoor Access

Researchers and threat intelligence sources detailed multiple signed Windows kernel drivers being abused to gain stealthy, high-privilege access and disable defenses. Nextron Systems analyzed wskmon.sys, a WHQL-signed Windows Filtering Platform driver that acts as a kernel-resident network backdoor by intercepting inbound TCP traffic and accepting encrypted, HMAC-authenticated commands marked with the magic bytes 7F 4E 54 46. The malware reportedly enables remote shell execution, arbitrary file writes, and shellcode execution directly from kernel context, allowing it to operate on Secure Boot systems while leaving few user-mode artifacts.

Separate LOLDrivers entries highlighted two additional signed drivers tied to ESET’s reporting on Gentlemen ransomware activity: Qihoo’s 360netmon_wfp.sys, tracked as Win64/VulnDriver.Qihoo360.A, and IObit Malware Fighter’s IMFForceDelete.sys, associated with CVE-2019-6494. The first can be abused to impair endpoint protections and support EDR-killing activity, while the second can be loaded to delete protected files regardless of access controls via IOCTL 0x8016E000. Across the reports, defenders were urged to block these drivers, monitor for suspicious signed driver loads and unexpected WFP callout registration, and hunt for indicators such as anomalous svchost.exe child processes, kernel-originated file overwrites, and protocol markers in network traffic.