Key Takeaways<\/p>\n
- \n
- A signature is no shield.<\/strong> A validly signed kernel driver named PoisonX terminates endpoint defense processes and removes their hooks. The console stays silent.<\/li>\n
- Admin rights are enough.<\/strong> Windows automatically loads the signed driver into the kernel. No additional exploit or CVE required.<\/li>\n
- Detection beats trust.<\/strong> Driver-load telemetry, the vulnerable-driver blocklist, and strict least-privilege policies step in where signature checks fail.<\/li>\n<\/ul>\n<\/div>\n
Related:<\/strong> What really sets EDR and XDR apart<\/a> \u00b7 How a ransomware attack unfolds<\/a><\/p>\n
What lies behind the signed driver<\/h2>\n
What is a BYOVD attack?<\/strong> Bring Your Own Vulnerable Driver (BYOVD) describes a technique where an attacker with administrator rights installs a validly signed but flawed or malicious driver on the system. Windows verifies the signature, finds it valid, and loads the driver into the kernel-no additional exploit needed.<\/p>\n
In the GodDamn case, the driver is named PoisonX and carries a genuine signature from the Microsoft Windows Hardware Compatibility Publisher. Symantec highlights a key difference: classic BYOVD abuses a legitimate but vulnerable driver, whereas PoisonX is a malicious driver from the start, engineered to pass signature checks. Once loaded, it terminates the processes of installed endpoint defenses and removes the user-mode hooks that antivirus and EDR tools use to monitor the system. The agent remains technically active, but its visibility is gone.<\/p>\n
GodDamn itself isn\u2019t new. Broadcom attributes the family to an actor called Hyadina and sees it as the successor to Beast, which evolved from the older Monster lineage. PoisonX, however, isn\u2019t exclusive to this group-it\u2019s already documented in other toolkits, making it a widely used component, not an isolated case.<\/p>\n
The long prelude before encryption<\/h2>\n
Encryption is the final act, not the opening move. In the campaign described by Symantec, attackers gained access via the remote administration tool AnyDesk, placing it in an inconspicuous location within the user profile. Next came a bundle of freely available NirSoft tools to harvest credentials.<\/p>\n
Only then did the attackers move laterally through the network, disabling Defender using its own administrative commands and setting up persistence services. By the time ransomware was deployed, around ten systems had been compromised. This prelude can last hours or even days-it\u2019s the real detection window.<\/p>\n
Why Signature Trust Reaches Its Limits<\/h2>\n
The common assumption is: what\u2019s signed is trustworthy. The PoisonX case disproves this. A valid signature confirms a code\u2019s origin-but says nothing about its intent. Once an attacker gains administrator privileges, the signature becomes a free pass into the kernel.<\/p>\n
Microsoft counters this with a blocklist of known problematic drivers and hypervisor-protected code integrity. Both measures help, but they act reactively. There\u2019s a window between discovering a misused driver and adding it to the blocklist. Not every system has core isolation enabled. Compatibility with legacy software further delays adoption.<\/p>\n
What Detection Engineering Actually Delivers<\/h2>\n
The leverage lies in behavior, not signatures. Loading a kernel driver is a rare, highly observable event. Sysmon logs it with hash, signature status, and path. A driver loaded from a user directory instead of the system folder is a strong red flag.<\/p>\n
Equally telling: the creation of a kernel service from an unusual source, or the sudden termination of security processes. Correlate these three events, and you\u2019ll spot the attack before encryption even begins.<\/p>\n
\nCheck Immediately<\/p>\n
- \n
- ✓<\/span>Enable core isolation and memory integrity (HVCI) on endpoints where hardware and drivers permit.<\/li>\n
- ✓<\/span>Enforce Microsoft\u2019s Vulnerable Driver Blocklist and supplement it with custom WDAC rules against known malicious drivers from LOLDrivers.<\/li>\n
- ✓<\/span>Set up alerts for driver-load events (Sysmon Event 6) targeting unusual paths, and monitor kernel service installations (System Log 7045).<\/li>\n
- ✓<\/span>Activate EDR tamper protection to prevent attackers from disabling the agent.<\/li>\n
- ✓<\/span>Remove local admin rights for daily use; enforce LAPS and a tiered access model.<\/li>\n<\/ul>\n<\/div>\n
Least Privilege as the Foundation<\/h2>\n
All the controls mentioned share one prerequisite: without administrator rights, no attacker loads a driver into the kernel. That\u2019s why least privilege sits at the start of any effective defense-not the end.<\/p>\n
In practice, this means: no permanent local admin rights, just-in-time access for privileged tasks, LAPS for local accounts, and a tiered model that keeps domain admins off endpoints. Blocklists, HVCI, and telemetry only work if widespread admin rights don\u2019t already do half the attackers\u2019 work for them.<\/p>\n
Frequently Asked Questions<\/h2>\n
Each question is locked. Tap to unlock the answer.<\/p>\n
\nWhat is a BYOVD attack?<\/strong><\/summary>\n
Bring Your Own Vulnerable Driver refers to an attacker injecting a validly signed but flawed or malicious driver using administrator privileges. Windows trusts the signature and loads the driver into the kernel, where it operates with the highest system rights.<\/p>\n<\/details>\n
\nIs an up-to-date EDR solution enough to counter this technique?<\/strong><\/summary>\n
Not on its own. The signed driver targets defenses directly, effectively blinding them. Detection only becomes effective when combined with tamper protection, driver telemetry, and restricted administrator rights.<\/p>\n<\/details>\n
\nDoes Microsoft\u2019s Vulnerable Driver Blocklist provide reliable protection?<\/strong><\/summary>\n
It helps, but it\u2019s reactive. There\u2019s a window between the discovery of a driver and its inclusion on the list. Custom WDAC rules targeting known abusive drivers can help close this gap.<\/p>\n<\/details>\n
\nHow can you spot this attack in logs?<\/strong><\/summary>\n
Three key events stand out: loading a kernel driver from a user directory, creating a kernel service from an unusual source, and the sudden termination of security processes. When correlated, these paint a clear picture.<\/p>\n<\/details>\n
\nWhat\u2019s the most critical first step?<\/strong><\/summary>\n
Reducing widespread administrator rights. Without these privileges, no driver can be loaded into the kernel. All other security measures build on this foundation.<\/p>\n<\/details>\n
Editor’s Picks<\/h3>\n
![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/was-ist-edr-xdr-cover-hero-250x143.jpg\")
<\/span>Editor’s Pick<\/span>What Really Sets EDR and XDR Apart<\/span><\/span><\/a>![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/was-ist-ransomware-cover-hero-250x143.jpg\")
<\/span>Editor’s Pick<\/span>How a Ransomware Attack Unfolds<\/span><\/span><\/a>![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/06\/sov-report-2026-schwachstellen-tempo-cover-hero-250x141.jpg\")
<\/span>Editor’s Pick<\/span>When Attackers Outpace the Patch<\/span><\/span><\/a><\/p>\nMore from the MBF Media Network<\/h3>\n
![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/net-ki-modell-denken-anthropic-j-space-86585047.jpg\")
<\/span>cloudmagazin<\/span>For the first time, you can watch an AI think<\/span><\/span><\/a>![\"\"](\"https:\/\/mybusinessfuture.com\/wp-content\/uploads\/2026\/07\/ki-mittelstand-pilot-skalierung-roi-roadmap-cover-hero-760x434.jpg\")
<\/span>MyBusinessFuture<\/span>From pilot to scale: AI in SMEs<\/span><\/span><\/a>![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/net-konglomerat-holding-aumovio-tkms-siemens-42852037-250x143.jpg\")
<\/span>Digital Chiefs<\/span>IT determines whether the spin-off pays off<\/span><\/span><\/a><\/p>\nImage source: AI-generated (July 2026)<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"Cybersecurity: A Microsoft-signed kernel driver disables EDR protection. Why signature trust fails and which detection is now effective.","protected":false},"author":10,"featured_media":21989,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_yoast_wpseo_focuskw":"Supply chain attack","_yoast_wpseo_title":"A Signed Driver Makes Endpoint Protection Blind","_yoast_wpseo_metadesc":"The original German text is: \"Cybersecurity: Ein Microsoft-signierter Kernel-Treiber schaltet den EDR-Schutz ab.","_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_meta-robots-adv":"","_yoast_wpseo_canonical":"","_yoast_wpseo_opengraph-title":"","_yoast_wpseo_opengraph-description":"","_yoast_wpseo_opengraph-image":"","_yoast_wpseo_opengraph-image-id":0,"_yoast_wpseo_twitter-title":"","_yoast_wpseo_twitter-description":"","_yoast_wpseo_twitter-image":"","_yoast_wpseo_twitter-image-id":0,"evm_cvss":0,"evm_risk":0,"evm_casefile":"","evm_primary_cve":"","_evm_translation_lang":"","featured_post":0,"featured_post_sortierung":0,"_wp_old_slug":[],"footnotes":""},"categories":[254],"tags":[74],"class_list":["post-22002","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-praxis-umsetzung","tag-ransomware"],"evm_reading_time_minutes":6,"wpml_language":"en","wpml_translation_of":21988,"_links":{"self":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/22002","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/comments?post=22002"}],"version-history":[{"count":1,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/22002\/revisions"}],"predecessor-version":[{"id":22003,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/22002\/revisions\/22003"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media\/21989"}],"wp:attachment":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media?parent=22002"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/categories?post=22002"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/tags?post=22002"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
- ✓<\/span>Enforce Microsoft\u2019s Vulnerable Driver Blocklist and supplement it with custom WDAC rules against known malicious drivers from LOLDrivers.<\/li>\n
- Admin rights are enough.<\/strong> Windows automatically loads the signed driver into the kernel. No additional exploit or CVE required.<\/li>\n