BYOVD (Bring Your Own Vulnerable Driver).

An attack technique where adversaries load a legitimately signed but vulnerable kernel driver, then exploit its flaw to gain kernel-level access and disable security tools. It belongs to the Attacks & Threats category of cybersecurity.

An attack technique where adversaries load a legitimately signed but vulnerable kernel driver, then exploit its flaw to gain kernel-level access and disable security tools.

Bring Your Own Vulnerable Driver (BYOVD) is a defense-evasion and privilege-escalation technique in which an attacker deploys a legitimately code-signed but vulnerable kernel-mode driver onto a target system and abuses its flaw to execute code or read and write memory in the kernel. Because the driver carries a valid digital signature, it loads even on systems enforcing driver signature enforcement, giving the adversary ring-0 privileges that user-mode controls cannot stop. From the kernel, attackers commonly terminate or blind endpoint protection, remove process protections, install rootkits, or tamper with logging. Defenses include Microsoft's vulnerable driver blocklist, Hypervisor-Protected Code Integrity (HVCI), and attack-surface-reduction rules; the community LOLDrivers project catalogs known-vulnerable drivers.

Defences for BYOVD (Bring Your Own Vulnerable Driver) typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Bring Your Own Vulnerable Driver, vulnerable driver abuse.