Bypass Record
BYOVD (Vulnerable Driver) × Microsoft Windows Driver Signature Enforcement
A publicly-reported instance of BYOVD (Vulnerable Driver) bypassing Microsoft Windows Driver Signature Enforcement, recorded with its original source. Factual record; no assessment of any specific deployment.
Mechanism
A kernel-mode driver patches the g_CiOptions global variable to disable DSE, allowing unsigned drivers to load. The driver can be manually mapped (e.g., via kdmapper) to avoid detection. PatchGuard protection on CI.dll is bypassed using third-party tools or by re-enabling DSE after operations.
Detection & mitigation
Monitor for loading of known vulnerable or suspicious drivers (e.g., via Sysmon Event ID 6 or 7) and kernel-mode callbacks that modify g_CiOptions; enforce driver blocklist policies (e.g., WDAC) and enable Secure Boot to prevent unsigned driver loading.
This is a record of a publicly-reported event, not an assessment of any specific organization's deployment. Detection and mitigation notes are drawn from the cited source. Where the source is silent, fields are omitted.