Bypass Record
BYOVD (Vulnerable Driver) × Palo Alto Networks Cortex XDR
A publicly-reported instance of BYOVD (Vulnerable Driver) bypassing Palo Alto Networks Cortex XDR, recorded with its original source. Factual record; no assessment of any specific deployment.
Mechanism
Reynolds embeds the signed but vulnerable NSecKrnl driver inside its ransomware binary. Upon execution, the driver exploits CVE-2025-68947 to terminate security processes (e.g., CrowdStrike Falcon, Cortex XDR) with sufficient privileges, then encrypts files without dropping a separate driver file, evading disk-based detection.
Detection & mitigation
Monitor for unexpected termination of EDR processes (e.g., via Sysmon Event ID 5 or EDR self-protection alerts) and block known vulnerable drivers like NSecKrnl using Microsoft's driver blocklist or AppLocker. Deploy application control policies to restrict which drivers can load, and ensure EDR tamper protection is enabled.
This is a record of a publicly-reported event, not an assessment of any specific organization's deployment. Detection and mitigation notes are drawn from the cited source. Where the source is silent, fields are omitted.