Bypass Record
BYOVD (Vulnerable Driver) × Various EDR vendors Over 300 endpoint security products
A publicly-reported instance of BYOVD (Vulnerable Driver) bypassing Various EDR vendors Over 300 endpoint security products, recorded with its original source. Factual record; no assessment of any specific deployment.
Mechanism
Attackers gain initial access, then use DLL sideloading to drop a malicious DLL that loads a vulnerable signed driver (e.g., rwdrv.sys). The driver provides kernel memory access, allowing the malware to zero out EDR callback registrations (PsSetCreateProcessNotifyRoutine, etc.) and bypass Protected Process Light (PPL) to terminate security processes. Ransomware then executes in a blind environment.
Detection & mitigation
Monitor for the loading of known vulnerable drivers (e.g., rwdrv.sys) via Sysmon Event ID 6 (driver loaded) or EDR telemetry, and correlate with unexpected process terminations of security products. Mitigation includes enforcing Microsoft's vulnerable driver blocklist (via WDAC or HVCI) and restricting driver loading to only trusted, signed drivers.
This is a record of a publicly-reported event, not an assessment of any specific organization's deployment. Detection and mitigation notes are drawn from the cited source. Where the source is silent, fields are omitted.