Loading story…
Elastic Security Labs said Elastic Defend now detects more than 800 known vulnerable Windows drivers used in bring-your-own-vulnerable-driver (BYOVD) attacks, a technique that lets attackers load legitimately signed but flawed drivers to gain kernel-level access, tamper with memory, and disable security tools. The expanded coverage builds on an automated pipeline that monitors public sources including VirusTotal, LOLDrivers, and Microsoft’s Vulnerable Driver Block List to rapidly generate and ship new YARA-based detections; Elastic said its coverage started in 2023 with 65 rules and has since grown substantially.
The update comes as BYOVD remains a favored tactic in ransomware and intrusion campaigns, with Elastic and other researchers pointing to abuse of Avast’s signed anti-rootkit driver aswArPot.sys in Cuba ransomware activity and GHOSTENGINE operations. Elastic said the product also applies layered protections such as vulnerable-driver blocklist validation before driver load and alerts on first-seen drivers, while related platform updates add automated troubleshooting in Elastic Agent Builder and support for Windows on ARM in Elastic Defend.
See real exploitation activity before you spend the cycle.
5 events from the most recent confirmed update back to the earliest known activity.
Elastic states its automated process for generating vulnerable-driver detection rules began in 2023. The effort started with coverage for 65 vulnerable drivers.
Elastic Defend now supports Windows on ARM. Elastic says Snapdragon laptops, Copilot+ PCs, and ARM workstations can enroll under existing policies and report the same telemetry as x64 endpoints.
Elastic Agent Builder now includes automatic troubleshooting capabilities. Elastic says this covers issues such as third-party antivirus conflicts, policy application failures, and other troubleshooting errors.
Elastic publishes every generated vulnerable-driver rule publicly in its elastic/protections-artifacts repository. The repository shows which driver triggered a rule, which source flagged it, and the detection logic.
Elastic says its vulnerable-driver rule library now covers more than 800 known vulnerable drivers. The coverage is generated from monitored public disclosure sources and made recognizable by Elastic Defend without customer-side updates or settings changes.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourceelastic.co
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers and incident responders reported continued abuse of **Bring Your Own Vulnerable Driver (BYOVD)** techniques to disable endpoint protections, including **CrowdStrike Falcon**, by loading legitimately signed but flawed Windows kernel drivers. One newly analyzed zero-day driver family included more than 15 variants with valid Microsoft signatures and an IOCTL path such as `0x22E010` that accepted a process ID and invoked `ZwOpenProcess` and `ZwTerminateProcess` from kernel mode, allowing attackers to kill protected security processes without alerts. A proof-of-concept dubbed **PoisonKiller** demonstrated successful termination of the CrowdStrike EDR process through the driver’s symbolic link, underscoring the risk created by trusted but unrevoked third-party drivers. Separate reporting from Sophos and industry coverage tied the same broader tactic to real intrusions and ransomware activity, including ongoing abuse of **Terminator** and related tools built around vulnerable **Zemana** drivers. Attackers used IOCTL flaws to place their own processes on allow lists and then terminate AV and EDR components, while some incidents showed operators switching to alternatives such as **AuKill** when initial attempts failed. Defenders were urged to combine tamper protection, strict privilege controls, patching, and aggressive blocklisting of unnecessary vulnerable drivers, as signed-driver abuse has spread from advanced actors to commodity ransomware crews and lower-tier criminals.
Jun 30, 2026
Ransomware operators are using **Bring Your Own Vulnerable Driver (BYOVD)** attacks to load legitimately signed but flawed Windows kernel drivers, gain ring-0 access, and terminate security products protected by Protected Process Light (PPL). Reported examples include the WatchDog Antimalware v1.1.100 and `eb` kernel drivers, whose unauthenticated IOCTL interfaces can reportedly be abused to kill protected processes. Qilin's Killer Ultra and RansomHub's EDRKillShifter have used the technique through user-mode launchers that drop, load, and control vulnerable drivers. Defenders should detect the sequence of suspicious driver drops, rapid driver installation or loading, low-prevalence driver hashes, and subsequent termination of endpoint-security processes. Organizations should inventory and baseline deployed drivers, enforce Windows Defender Application Control (WDAC) driver policies, enable Microsoft’s Vulnerable Driver Blocklist and HVCI, maintain EDR tamper protection, and restrict administrative privileges to reduce exposure to known vulnerable drivers, including those catalogued by LOLDrivers.
Sep 28, 2026
**ESET Research** reported that **EDR killers** have become a standard component of modern ransomware operations, with attackers routinely disabling endpoint detection and response tools before launching encryptors. Across nearly 90 EDR killer tools observed in the wild, 54 were found to use the **Bring Your Own Vulnerable Driver (BYOVD)** technique, abusing 34 signed but vulnerable drivers to obtain kernel-level privileges and tamper with security products. The research says this approach is especially attractive to ransomware affiliates because it creates a short, reliable window for encryption while avoiding the need to constantly rebuild encryptors to evade detection. The reporting also highlights how **ransomware-as-a-service** operations contribute to the diversity of EDR killer tooling: operators typically provide the encryptor and infrastructure, while affiliates choose the EDR-disabling utility used during an intrusion. Although BYOVD remains the dominant method because of its reliability and relatively low development cost, researchers also observed a growing set of tools that disable protections without loading drivers, including methods that disrupt EDR communications, suspend processes, or abuse built-in administrative utilities. The findings reinforce that vulnerable-driver abuse remains a key defensive gap, while non-kernel alternatives are also expanding the range of pre-encryption attack techniques defenders must monitor.
Jul 12, 2026