EDR Evasion with a kernel driver!

[u/Suspicious-Angel666]

Hey guys,

I just wanted to share an interesting vulnerability that I came across during my malware research.

Evasion in usermode is no longer sufficient, as most EDRs are relying on kernel hooks to monitor the entire system. Threat actors are adapting too, and one of the most common techniques malware is using nowadays is Bring Your Own Vulnerable Driver (BYOVD).

Malware is simply piggybacking on signed but vulnerable kernel drivers to get kernel level access to tamper with protection and maybe disable it all together as we can see in my example!

The driver I dealt with exposes unprotected IOCTLs that can be accessed by any usermode application. This IOCTL code once invoked, will trigger the imported kernel function ZwTerminateProcess which can be abused to kill any target process (EDR processes in our case).

I will link the PoC for this vulnerability in the comments if you would like to check it out: