Bring Your Own Vulnerable Driver, or BYOVD, is an attack technique where an intruder installs a legitimate, correctly signed Windows driver that happens to contain a vulnerability, then abuses that flaw to run code in the kernel and switch off security software. It has become one of the most reliable ways ransomware crews blind endpoint defences before encrypting. By March 2026, researchers counted 54 distinct EDR-killer tools abusing 35 different signed drivers, which is why BYOVD moved from niche tradecraft to a standard ransomware enabler.
Why does a signed driver matter?
Windows trusts kernel drivers, and it enforces that trust with code signing. A driver carrying a valid signature from a recognised vendor loads without complaint, because the operating system assumes a signed driver is a safe one. BYOVD weaponises that assumption. The attacker does not need to forge a signature or find a Windows zero-day. They bring a real driver, signed by a real company, that simply contains an exploitable bug. Because the signature is genuine, the driver sails past the checks meant to keep hostile kernel code out. The vulnerability inside it is the payload.
How does a BYOVD attack actually work?
The sequence is short and, by this stage of an intrusion, the attacker already has administrator rights on the host. They drop the vulnerable driver to disk and load it, gaining a foothold in the kernel through its flaw. Kernel code sits below the security tools that run in user space, which means it can reach in and terminate or disable them. With EDR and antivirus silenced, the attacker moves freely: credential theft, lateral movement and finally encryption, all without the alerts that would normally fire. The whole point is to fight from higher ground than the defender’s own sensors occupy.
What is LOLDrivers, and how do attackers shop for drivers?
Attackers do not audit drivers themselves. They consult public catalogues. LOLDrivers, short for Living Off The Land Drivers, is an open community project that indexes signed drivers known to be vulnerable or malicious, complete with hashes and detection guidance. It exists to help defenders, but it doubles as a shopping list for offence. The same research that tells a blue team which drivers to block tells a red team, or a ransomware affiliate, which drivers still work. This dual-use tension runs through the whole BYOVD problem: the knowledge that defends is the knowledge that attacks.
Why doesn’t Microsoft’s blocklist fix this?
Microsoft ships a Vulnerable Driver Blocklist that stops known-bad drivers from loading, and on current Windows builds it is on by default. It helps, but it is not a cure for three reasons. First, it covers only a subset of known vulnerable drivers, not all of them. Second, there is a lag, often weeks, between a driver being identified as abusable and the blocklist update reaching enterprise endpoints. Third, older or misconfigured systems may not enforce it at all. Attackers exploit exactly these gaps, favouring drivers that are vulnerable but not yet blocked. Reporting through 2025 and 2026 tied active BYOVD use to crews including Qilin and others, which shows the blocklist buys time rather than closing the door.
How do you defend against BYOVD?
Defence is layered, because no single control stops it. Turn on the Microsoft blocklist and hypervisor-protected code integrity so the kernel rejects known-bad and unsigned drivers. Go further with application-control policies such as WDAC that permit only an approved list of drivers, which flips the model from blocklist to allowlist. Monitor for new kernel driver loads and match them against LOLDrivers hashes, since a fresh, rarely-seen driver appearing on a workstation is a strong signal. Above all, restrict local administrator rights: BYOVD needs admin to install the driver in the first place, so tight privilege control removes the precondition. These behaviours are what a capable business EDR platform should catch, and they pair with the driver-abuse cases we have covered in groups like The Gentlemen.
Frequently asked questions
What does BYOVD stand for?
BYOVD stands for Bring Your Own Vulnerable Driver. It describes attackers loading a legitimate, signed Windows driver that contains a vulnerability, then exploiting that flaw to run kernel code and disable security tools.
Why do ransomware groups use BYOVD?
It reliably disables EDR and antivirus from the kernel, below where those tools operate, letting attackers move and encrypt without triggering alerts. It also avoids needing a Windows zero-day, since the vulnerability lives in a third-party driver.
Does BYOVD need administrator rights?
Yes. Installing a kernel driver requires administrator privileges, so BYOVD is a post-exploitation technique used after an attacker already has elevated access. Restricting local admin rights removes the precondition.
What is LOLDrivers?
LOLDrivers is an open community project cataloguing signed drivers known to be vulnerable or malicious, with hashes and detection guidance. It helps defenders block abusable drivers, but attackers also use it to find drivers that still work.
Does Microsoft’s Vulnerable Driver Blocklist stop BYOVD?
It reduces the risk but does not eliminate it. The blocklist covers only some vulnerable drivers, updates reach endpoints with a lag, and older systems may not enforce it, so attackers favour drivers that are vulnerable but not yet blocked.