The feature that stops BYOVD (bring your own vulnerable driver)

This report explains how BYOVD (Bring Your Own Vulnerable Driver) attacks exploit legitimately signed but vulnerable drivers to achieve kernel-level compromise, demonstrates the limitations of driver blocklists (like Microsoft’s Vulnerable Driver Blocklist), and recommends a deny-by-default strategy using Windows Defender Application Control (WDAC) combined with Hypervisor‑Protected Code Integrity (HVCI), Active Directory/GPO deployment patterns, and complementary controls (VBS, disabling legacy cross-signing, ASR rules, community blocklists) to mitigate the threat.