Bring Your Own Vulnerable Driver
Source: YouTube · Huntress · published Nov 3, 2026 · 15:56
BLUF: Greg Bailey (Huntress SOC manager) explains how attackers abuse signed-but-vulnerable drivers (BYOVD) for kernel access, EDR removal, and ransomware 0:33.
Key Takeaways:
• Attack chain: get admin, drop signed vulnerable driver, kill EDR/AV, deploy ransomware 1:28
• Windows only checks signatures, cert chain, and block lists—never whether a driver exposes raw physical memory or validates callers 2:57
• TruSight ("killing is its day job") kills EDR out of the box; legacy 2.02 version dodges block lists 4:39
• Real cases: RT Core 64 + ASRock drivers in the wild 8:19; SonicWall VPN (no MFA) with EnCase driver blinding telemetry 9:33; fake Google tax ads dropping ScreenConnect plus an EDR-killer audio driver 10:34; Nitrogen ransomware via compromised MSP RMM using SafetyCut.sys across hundreds of tenants 11:49
• Detection: Sysmon events for .sys in user-writable paths, kernel service registration, driver load events, or worst—lost telemetry 13:19
• Defenses: enforce MFA, inventory RMMs, deploy Microsoft block lists via GPO, treat drivers outside the system directory as suspicious 14:44
Every path starts with initial access—basic controls like MFA remain the strongest defense against this commodity tradecraft 11:37.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
My name is Greg, uh, Bailey. I
work here at Huntress in the SOC. So I'm a manager in the
security operations center. I actually started as a principal. So, um, I was an individual contributor up until
a few months ago when they said, "Hey, Greg, uh, you wanna be in management
again?" And I reluctantly said, "Absolutely not." And then here I
am as a manager in, uh, in the org. But I did that because we have
an awesome team. And part of, part of what I get to do on a daily
basis is deal with this kind of stuff, which I really, really like. So we're gonna talk about bring
your own vulnerable driver. And I used to be a red teamer and a pen
tester for years and years and years. And so one of the first kind of, uh, blocks that we run into is
of course, AV, EDR, right? So we have to bypass it som…