BYOVD (Vulnerable Driver) × Microsoft WatchDog Antimalware driver

exploiting a previously unknown vulnerable Microsoft-signed WatchDog Antimalware driver to terminate protected endpoint processes

The attackers leverage a vulnerable Microsoft-signed WatchDog Antimalware driver (BYOVD) to gain kernel-level access and terminate protected processes, including those of EDR/AV solutions. A dual-driver approach ensures compatibility across Windows versions. After vendor patching, the attackers modified the driver to evade blocklists while retaining its valid signature, allowing continued abuse.

Monitor for unexpected driver loads (Sysmon Event ID 6) and process termination events targeting security products. Enforce strict driver signing policies via WDAC to block unapproved drivers even if signed, and hunt for anomalies in kernel-level behavior.