BYOVD (Vulnerable Driver) × Microsoft Defender

tested against Microsoft Defender and Elastic EDR, allowing execution of tools like Mimikatz without detection

A custom kernel-mode minifilter driver registers a preoperation callback that intercepts file I/O operations. The callback checks if the file path matches a list of EDR-related files and returns STATUS_ACCESS_DENIED, preventing the EDR from accessing its own components and thus stopping its processes from running.

Monitor for the loading of unexpected or newly signed minifilter drivers via Event ID 6 (driver load) and 11 (minifilter registration) in the Microsoft-Windows-FilterManager operational log. Correlate with Sysmon Event ID 7 (image load) for unsigned or unusual driver loads, and enforce driver signing policies with WDAC to block unapproved drivers.