Bring Your Own Vulnerable Driver: The Trust Gap Attackers Operate Inside

This report analyzes BYOVD (Bring Your Own Vulnerable Driver) abuse and argues defenders should stop chasing blocklisted driver hashes and instead instrument and score the signing/trust event. It presents evidence that Windows' kernel trust model and slow blocklist propagation let revoked or expired certificates and cross-signed drivers continue to load (citing LOLDrivers catalog statistics and several real-world EDR-killer cases), documents a measurable persistence "half-life" (roughly one-third of catalogued vulnerable drivers absent from the default blocklist in a June 2026 pull), and prescribes detection guidance—monitor Sysmon Event ID 6, signature-status, first-seen anomalies, and CodeIntegrity logs—while noting platform changes that improve but do not eliminate the exposure.