security-com Jun 30, 2026 · Crawled Jul 31, 2026

The BYOVD Epidemic: How Attackers Are Weaponizing Trusted Windows Drivers to Kill Security

1 IoCs 2 Malware

AI Summary

Attackers are increasingly leveraging the Bring Your Own Vulnerable Driver (BYOVD) technique to exploit legitimate, signed Windows kernel drivers and gain kernel-level privileges, enabling them to disable or bypass security software such as antivirus (AV) and endpoint detection and response (EDR) solutions. This method abuses flaws in trusted drivers like truesight.sys and those used by Microsoft Process Explorer, allowing attackers to terminate, suspend, or blind security processes. The technique has become widespread, with ready-made tools such as TrueSightKiller, GhostDriver, AuKill, and Poortry being integrated into ransomware-as-a-service (RaaS) offerings, making it a common component of modern ransomware attack chains.

AI-extracted · verify before operational use

Extracted Entities 2 found

Malware AuKill → Malware POORTRY →

Indicators of Compromise 1 extracted

Type	Value	Detail
Filename	truesight.sys	Details →

MITRE ATT&CK TTPs 5 techniques

T1055 Process Injection · Defense Evasion T1068 Exploitation for Privilege Escalation · Privilege Escalation T1082 System Information Discovery · Discovery T1497.001 System Checks · Defense Evasion T1562.001 Disable or Modify Tools · Defense Evasion