Unveiling BYOVD Threats: Malware's Use and Abuse of Kernel Drivers

Unveiling BYOVD Threats: Malware's Use and Abuse of Kernel Drivers

Speakers: Andrea Monzani

Conference: NDSS Symposium 2026

YouTube: https://www.youtube.com/watch?v=wj_gFhKIJ6w

Overview

Bring Your Own Vulnerable Driver (BYOVD) is an increasingly prevalent technique where attackers use legitimate, signed kernel drivers containing exploitable flaws to achieve kernel-level privilege escalation, kill security solutions, access arbitrary memory, or load unsigned drivers. Detected in state-sponsored espionage and ransomware operations like Qilin 2025, BYOVD exploits the trust placed in digitally signed drivers to bypass Windows kernel protections. This talk presents the first virtualization-based sandbox for monitoring BYOVD behavior, built by extending DRAKVUF with a custom plugin called KernelMon that hooks driver loads, IOCTL handlers, and kernel structures to trace multi-stage exploitation chains across user-kernel boundaries. Testing on a real-world malware dataset, the researchers identified 48 suspicious drivers, of which 7 were previously unknown vulnerable and exploitable drivers reported to Microsoft and vendors.

Background

▶ Watch: BYOVD technique: legitimate signed drivers exploited for kernel attacks (0:30)

Windows protects security solutions by running them as Protected Processes, shielding them from user-mode attacks. BYOVD bypasses this by loading a legitimate signed driver into the kernel and using its capabilities to forcefully terminate EDR processes from kernel space. Since the driver is validly signed, Windows permits its loading, and since malware runs as administrator, it can load drivers and send IOCTLs to exploit them. Existing sandboxes have user-mode visibility only and are blind to kernel-space abuses, creating a significant gap in malware analysis.

Key Findings

▶ Watch: DRAKVUF sandbox architecture with KernelMon plugin (4:00)

A taxonomy of BYOVD observable behaviors was developed from existing research, including: protected process termination (via ZwTerminateProcess), dynamic code execution (writable+executable kernel memory), kernel structure modification (CI Options variable for code integrity tampering), and others. The KernelMon plugin hooks driver load routines, IOCTL handlers, all driver-registered callbacks, and kernel functions/structures to trace the complete driver lifecycle. Among 48 suspicious drivers from the potentially vulnerable dataset, 7 were confirmed vulnerable and exploitable -- including a malicious driver specifically signed for killing EDR (KV Service), an old Microsoft driver (termd8.sys) vulnerable to buffer overflow for code integrity tampering (still loadable on Windows 10/11), and a minifilter driver (probamond.sys) exploitable for protected process termination via FilterSendMessage.

Technical Deep Dive

▶ Watch: Dataset construction from VirusTotal drivers and execution parents (6:00)

The sandbox architecture uses DRAKVUF, a hypervisor-based analysis platform, extended with KernelMon for kernel-level behavioral tracing. Sample execution runs for 2 minutes with comprehensive hooking. After execution, an analyzer reconstructs data flow using reconstruction rules to detect behavioral chains consistent with BYOVD exploitation. The dataset was constructed from VirusTotal driver samples and their execution parents (dropper binaries), filtered by VT detection scores to separate potentially benign parents (<6 detections) from certainly malicious (>49). Of 611 potentially vulnerable drivers, 118 were observed loading during sandbox execution, and 48 exhibited suspicious behaviors.

Demo / Proof of Concept

▶ Watch: Case studies: KV Service EDR killer, termd8.sys code integrity bypass (10:00)

Five samples demonstrated code integrity tampering by overwriting the CI Options global variable using the termd8.sys driver. Three samples executed dynamic kernel code through the potentially vulnerable driver dataset. The KV Service driver was found to be purpose-built for EDR killing via a single IOCTL calling ZwOpenProcess and ZwTerminateProcess. All 7 vulnerable drivers were reported to Microsoft and respective vendors.

Defensive Implications

▶ Watch: Future work: automatic exploit generation using LLMs (11:30)

For EDR vendors, BYOVD represents a direct bypass of Protected Process protections. Driver blocklists and kernel-level monitoring should be priorities. For threat intelligence teams, the structural similarities across BYOVD exploitation patterns suggest opportunities for automated exploit generation detection. For Windows security teams, the finding that termd8.sys -- an old Microsoft driver -- was still loadable on Windows 10/11 underscores the need for comprehensive driver blocklist maintenance.

Key Takeaways

• BYOVD techniques are used in state-sponsored espionage and ransomware, bypassing Windows kernel protections
• Existing sandboxes lack kernel visibility; DRAKVUF-based KernelMon closes this gap
• 7 previously unknown vulnerable drivers discovered, including one still loadable on Windows 10/11
• Behavioral taxonomy enables systematic detection of protected process termination, code integrity tampering, and dynamic kernel code execution
• Structural similarities across BYOVD exploits suggest opportunities for automated detection and exploit generation

About the Speaker(s)

Andrea Monzani is a researcher at the University of Milan, with this work conducted in collaboration with Eurecom. The research focuses on kernel-level malware analysis and sandbox technology development.