BYOVD and EDR Killers: Turning a Signed Driver Into a Weapon

Bring Your Own Vulnerable Driver (BYOVD) is a kernel-level defense-evasion technique. An attacker who already has administrative rights loads a legitimately signed but vulnerable kernel driver onto Windows and exploits it to gain Ring-0 (kernel) code execution. Because the driver carries a valid signature, it loads without tripping driver-signature enforcement. From the kernel, the tooling terminates or blinds EDR and antivirus processes, removes kernel callbacks, or unhooks sensors — clearing the path for ransomware, data theft or backdoors. These “EDR killers” typically ship as a loader plus a chosen vulnerable driver.

How It Works

The attacker drops a known-vulnerable signed driver and installs it as a kernel service, then exploits its flaw to execute code at Ring-0. With kernel access, the EDR killer disables the security product’s protections from beneath the layer those products monitor. T1068 T1562.001 T1543.003 T1553.002

Notable Families

• AuKill (Sophos, 2023) abused an outdated Process Explorer driver and was seen before Medusa Locker and LockBit deployments.
• AvNeutralizer was attributed by SentinelLabs to FIN7 and later sold to multiple ransomware crews (the full customer list is a vendor assessment).
• EDRKillShifter (Sophos, 2024) is a loader that deploys a vulnerable driver, observed in a RansomHub-linked intrusion.
• POORTRY (a signed malicious driver) with the STONESTOP loader has been used by Scattered Spider and others. CrowdStrike reported Scattered Spider attempting to load a malicious driver via CVE-2015-2291 in an Intel diagnostics driver.

MITRE ATT&CK Mapping

Detection & Mitigation

• Enable Microsoft’s Vulnerable Driver Blocklist and HVCI / Memory Integrity, which block most known-bad drivers (the blocklist lags new discoveries, so it is not complete cover).
• Deploy driver allowlisting (WDAC) and audit new kernel-driver service creation; alert on drivers written to disk and then loaded.
• Cross-reference loaded drivers against the LOLDrivers project and alert on known-vulnerable driver names and hashes.
• Monitor for EDR sensor tamper or termination and sudden telemetry loss — often the last signal before ransomware deployment.