/
ttps_attack:T1543.003 × criticity:medium × limpar

Resultados

2 casos · pág. 1/1

sentinelone.com · medium

BYOVD trust gap: Windows kernel still loads revoked-certificate drivers; ~36% of LOLDrivers samples absent from default blocklist

SentinelOne analysis argues that bring your own vulnerable driver (BYOVD) succeeds because of a signing-trust gap rather than an incomplete driver list. The Windows kernel loads drivers signed with expired or revoked certificates, and a 2026 intrusion reported by Help Net Security used a decade-old forensic driver whose certificate had lo…

sentinelone.com · medium

BYOVD and EDR-Killer Hunting: Four Distinct Techniques Detection Teams Should Cover Separately Before Ransomware Deployment

SentinelOne argues that "EDR killer" covers four different techniques, and a single driver-load rule leaves blind spots. The four are bring-your-own-vulnerable-driver (BYOVD), bring-your-own-installer, admin-to-kernel, and driverless suspension. The article gives hunt logic for each and recommends rolling them out in order of signal quali…

FIN7 Qilin