/
← Voltar ao feed
medium

BYOVD trust gap: Windows kernel still loads revoked-certificate drivers; ~36% of LOLDrivers samples absent from default blocklist

1 fonte(s) · 1 atualização(ões) · publicado 13/10/2026 13:40 · coletado há 1 dia

SentinelOne analysis argues that bring your own vulnerable driver (BYOVD) succeeds because of a signing-trust gap rather than an incomplete driver list. The Windows kernel loads drivers signed with expired or revoked certificates, and a 2026 intrusion reported by Help Net Security used a decade-old forensic driver whose certificate had long been revoked. A small set of compromised keys, including a GitHub PFX file with a dozen-plus expired certificates from the 2015 Hacking Team leak, signed thousands of malicious drivers. Against the LOLDrivers catalog, the author's June 19, 2026 pull found 782 of 2,190 samples (36%) missing from the default Microsoft blocklist, and 479 (22%) loading even with HVCI enabled. These are point estimates from a single pull, with no independent second count.

Technical Details

  • Attackers forge signature timestamps to exploit the pre-July-29-2015 cross-signed certificate exception, making expired or revoked certificates usable again. Changing unauthenticated bytes alters the file hash while the same key signs the new artifact, defeating hash-based blocking.
  • The default blocklist updates only once or twice a year through Windows Update and deliberately holds back some blocks. A Windows 10 blocklist was reportedly frozen at a December 2019 version until an October 2022 fix. SentinelLABS disclosed Dell dbutil_2_3.sys flaws in 2021, and the driver was still used to disable security tooling in 2024 because its certificate was never revoked.
  • A blocked driver keeps running until reboot, and the ASR rule only prevents the driver being written to disk, not loaded if already present.
  • The typical EDR-killer chain: service creation via sc.exe (Sysmon Event ID 1, System Event 7045), driver load (Sysmon Event ID 6), then IOCTL-driven termination of protected processes (PPL) and unregistering of EDR kernel callbacks. One EDR killer shared by several ransomware gangs was tied together by a packer-as-a-service rather than a common driver.
  • A Windows security update in April 2026 removes default trust for cross-signed kernel drivers, but it is not retroactive for drivers already in circulation.

Remediation

  • Alert on Sysmon Event ID 6 driver loads with any non-Valid signature status, and on first-seen driver hash, signer or version on a host.
  • Use CodeIntegrity Operational log events 3099 (policy loaded), 3077 (blocked), 3076 (audit) and 3089 (signature detail) to verify blocklist enforcement.
  • Block expired and revoked-certificate driver loads in addition to the blocklist, and measure fleet exposure by matching loaded drivers by hash and Authenticode metadata (e.g. Trail of Bits' HVCI-loldrivers-check).
  • Detect on the behavioral chain (service creation, driver load, IOCTL-driven process termination) rather than on driver names or hashes.

Linha do tempo

  1. sentinelone.com ↗ · pub. 13/10/2026 13:40 · coletado 19/10 17:57 primeiro registro

    BYOVD trust gap: Windows kernel still loads revoked-certificate drivers; ~36% of LOLDrivers samples absent from default blocklist

    ler a análise desta fonte

    SentinelOne analysis argues that bring your own vulnerable driver (BYOVD) succeeds because of a signing-trust gap rather than an incomplete driver list. The Windows kernel loads drivers signed with expired or revoked certificates, and a 2026 intrusion reported by Help Net Security used a decade-old forensic driver whose certificate had long been revoked. A small set of compromised keys, including a GitHub PFX file with a dozen-plus expired certificates from the 2015 Hacking Team leak, signed thousands of malicious drivers. Against the LOLDrivers catalog, the author's June 19, 2026 pull found 782 of 2,190 samples (36%) missing from the default Microsoft blocklist, and 479 (22%) loading even with HVCI enabled. These are point estimates from a single pull, with no independent second count.

    Technical Details

    • Attackers forge signature timestamps to exploit the pre-July-29-2015 cross-signed certificate exception, making expired or revoked certificates usable again. Changing unauthenticated bytes alters the file hash while the same key signs the new artifact, defeating hash-based blocking.
    • The default blocklist updates only once or twice a year through Windows Update and deliberately holds back some blocks. A Windows 10 blocklist was reportedly frozen at a December 2019 version until an October 2022 fix. SentinelLABS disclosed Dell dbutil_2_3.sys flaws in 2021, and the driver was still used to disable security tooling in 2024 because its certificate was never revoked.
    • A blocked driver keeps running until reboot, and the ASR rule only prevents the driver being written to disk, not loaded if already present.
    • The typical EDR-killer chain: service creation via sc.exe (Sysmon Event ID 1, System Event 7045), driver load (Sysmon Event ID 6), then IOCTL-driven termination of protected processes (PPL) and unregistering of EDR kernel callbacks. One EDR killer shared by several ransomware gangs was tied together by a packer-as-a-service rather than a common driver.
    • A Windows security update in April 2026 removes default trust for cross-signed kernel drivers, but it is not retroactive for drivers already in circulation.

    Remediation

    • Alert on Sysmon Event ID 6 driver loads with any non-Valid signature status, and on first-seen driver hash, signer or version on a host.
    • Use CodeIntegrity Operational log events 3099 (policy loaded), 3077 (blocked), 3076 (audit) and 3089 (signature detail) to verify blocklist enforcement.
    • Block expired and revoked-certificate driver loads in addition to the blocklist, and measure fleet exposure by matching loaded drivers by hash and Authenticode metadata (e.g. Trail of Bits' HVCI-loldrivers-check).
    • Detect on the behavioral chain (service creation, driver load, IOCTL-driven process termination) rather than on driver names or hashes.