Bring Your Own Vulnerable Driver (BYOVD) is a named, publicly-documented class of technique in which an adversary who already holds local administrator rights loads a legitimately signed but known-vulnerable kernel driver, then abuses that driver's flaw to gain kernel-mode code execution and disable or blind EDR/AV. This entry catalogs the concept and detection surface only; it contains no driver-exploitation procedure.
Use Understand and detect kernel-level tampering where a signed vulnerable driver is used to kill or blind security tooling.
# BYOVD is documented here as a NAMED concept only. No exploitation steps are provided. Reference the LOLDrivers catalog for known-vulnerable signed drivers and the vendor blocklist for defensive coverage.
Detection: Monitor Sysmon Event ID 6 (driver loaded) and Security 4697/System 7045 (new kernel-mode service) for drivers matching LOLDrivers hashes/signatures or loading from user-writable paths. Enforce the Microsoft Vulnerable Driver Blocklist and WDAC/HVCI to block known-bad drivers. Alert on unexpected drivers signed by unrelated third parties on servers/workstations.
Verified
✓ Concept-only (no exploit steps); LOLDrivers.io is the canonical public catalog of known-vulnerable signed drivers and ATT&CK T1068 (Exploitation for Priv-Esc) + T1562.001 map to BYOVD; Sysmon 6 / Security 4697 / System 7045 detection is accurate. No change.