BYOVD (Vulnerable Driver) × Carbon Black Cloud Sensor

DLL sideloading via a Carbon Black update tool ... to achieve kernel-level memory manipulation ... disabling EDR

Attackers deploy a signed Carbon Black executable (upd.exe) that sideloads a malicious DLL (avupdate.dll). The DLL decodes and executes a customized EDRSandblast tool, which loads the vulnerable TPwSav.sys driver. The driver's IOCTL handlers allow arbitrary physical memory read/write, used to overwrite the BeepDeviceControl function in Beep.sys with shellcode. This shellcode provides unrestricted kernel memory access, enabling removal of EDR kernel callbacks and event tracing, effectively disabling EDR.

Monitor for the loading of known vulnerable drivers (e.g., TPwSav.sys) via Sysmon Event ID 6 (driver loaded) or EDR telemetry, and alert on their presence in non-standard paths or alongside suspicious process creation chains. Mitigate by blocking the hash or signature of vulnerable drivers using Windows Defender Application Control (WDAC) or driver block rules, and ensure EDR tamper protection is enabled to prevent kernel callback removal.