Bypass Record
BYOVD (Vulnerable Driver) × Microsoft Windows Defender
A publicly-reported instance of BYOVD (Vulnerable Driver) bypassing Microsoft Windows Defender, recorded with its original source. Factual record; no assessment of any specific deployment.
Mechanism
KVC operates in kernel mode to patch g_CiOptions or hijack skci.dll to disable Driver Signature Enforcement (DSE), allowing unsigned driver loading. It also manipulates Protected Process Light (PP/PPL) levels to access protected processes like LSASS for memory dumping, bypassing user-mode restrictions and HVCI/VBS.
Detection & mitigation
Monitor for loading of unsigned or newly seen kernel drivers via Windows Event ID 7045 (new service) and Sysmon Event ID 6 (driver loaded). Enforce driver blocklist policies (e.g., WDAC) and enable HVCI/VBS with secure boot to prevent DSE bypass.
This is a record of a publicly-reported event, not an assessment of any specific organization's deployment. Detection and mitigation notes are drawn from the cited source. Where the source is silent, fields are omitted.