Exploring vulnerable Windows drivers

This research overview examines the Bring Your Own Vulnerable Driver (BYOVD) technique: how legacy or poorly-permissioned signed drivers are abused to perform kernel-level actions (token stealing for privilege escalation, loading unsigned code, and disabling EDR/anti-cheat). It categorizes common driver vulnerability classes (arbitrary MSR writes, arbitrary kernel memory read/write, insufficient access controls), documents multiple 2024 ransomware campaigns and malware (Kasseika, Akira, Qilin, BlackByte, RansomHub, Gh0stRAT examples) that abused specific drivers and open-source tools to bypass protections, and recommends mitigations such as enabling HVCI/VBS, using driver blocklists, enforcing EV/WHQL drivers, and monitoring driver load events.