What BYOVD is
Bring your own vulnerable driver means a kernel driver that is signed, already has a known bug, and can be loaded by an account that is already an administrator.
This is not a remote bug. It starts from local admin. After that, the kernel is no longer a clean boundary between that admin and the rest of the machine.
I'm not publishing a lab for this URL. There is no harness and no procedure on this page.
What I check first
I check three things before I call a host covered:
- Memory integrity (HVCI) is on.
- The Microsoft vulnerable driver blocklist is enforced, or an equivalent Windows Defender Application Control policy is.
- Local admin is rare. A standard user should not be able to load a blocklisted driver.
How to detect it
- A new kernel driver that is not in your golden image.
- Code Integrity or Application Control events for a blocked driver.
- Memory integrity showing off in the endpoint inventory.
If those are quiet and Memory integrity is on, the common path is closed. If Memory integrity is off and local admins are everywhere, the control is missing even when you have no alert.
How to prevent it
Turn Memory integrity on. Apply the Microsoft driver blocklist. Take local admin off day-to-day accounts. Don't install random hardware tools that ship their own kernel driver.
That is the page. The masterclass this URL used to promise is not a lab I'm shipping.