You’re Driving Me Crazy: Analysing and Detecting BYOVD

Bring Your Own Vulnerable Driver (BYOVD) attacks exploit legitimately signed but flawed Windows kernel drivers to perform kernel-level actions—most critically terminating Protected Process Light (PPL) EDR/antivirus processes—bypassing user-mode protections. This report analyzes two drivers (WatchDog v1.1.100 and eb.sys), documents real-world ransomware toolchains and underground marketplaces selling EDR-killers, and provides a behavioral detection methodology (including KQL), incident response playbook, and hardening recommendations (WDAC, HVCI, driver inventory) to mitigate these high-impact attacks.