Bring-your-own-vulnerable-driver (BYOVD)
Signed vulnerable drivers loaded for kernel access to kill defences
categoryPhysical, insider and cross-cutting attacksseverityHighdetectability (measured in our lab)Lowlabdetected in lab
Example: 54 EDR killers, 35 drivers (ESET)
Detection opportunity what to watch for
A benign emulation of this technique’s linchpin behaviour — the command an attacker runs, and where we’ve detonated it in the lab, exactly what the SIEM saw, what caught it, and what it missed.
What the attacker runs
powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1685 -Tool atomic -RunId run-2026-10-20-014 -Command 'Invoke-AtomicTest T1685 -TestGuids 695eed40-e949-40e5-b306-b4031e4154bd -TimeoutSeconds 120'What our lab measured
failed windows · 2026-10-20
Classification
42 values: 2 lab-measured, 26 imported, 1 derived, 13 machine-classified. What do these mean?
Exploitability
| Attack vector | Software vulnerabilities |
|---|---|
| Reach (CVSS) | Local |
| Attack complexity | Low |
| Privileges required | High |
| User interaction | None |
| Attacker skill required | Medium |
| Resources required | Low |
| Likelihood / prevalence | High |
| Maturity | Commoditized |
Impact & scope
| Severity | High |
|---|---|
| Impact | AvailabilityIntegrity |
| Platform | ContainersESXiIaaSLinuxmacOSNetwork DevicesWindows |
| Environment | On-premises |
| Target asset class | Endpoint |
| Kill-chain phase (tactic) | Defense ImpairmentPrivilege Escalation |
Detection & telemetry
| Detectability (measured in our lab) | Low |
|---|---|
| Detectability (public detection content) | High |
| Noise level | High |
| Testability | Atomic Red Team test |
| Data sources (ATT&CK data components) | Cloud Service ModificationCommand ExecutionContainer EnumerationDriver LoadHost StatusLogon Session CreationModule LoadProcess AccessProcess CreationProcess TerminationService CreationService ModificationWindows Registry Key Modification |
| Attack permissions (ATT&CK) | User |
Detection & response
Mitigated by 17
- M1018 attack-mitigation
- M1019 attack-mitigation
- M1022 attack-mitigation
- M1024 attack-mitigation
- M1038 attack-mitigation
- M1042 attack-mitigation
- M1047 attack-mitigation
- M1048 attack-mitigation
- M1050 attack-mitigation
- M1051 attack-mitigation
- M1054 attack-mitigation
D3-MBTd3fendD3-PCSVd3fendD3-PSEPd3fendD3-SAORd3fendD3-SFCVd3fendD3-SSCd3fend
Detected by 235
- DET0497 attack-detection-strategy
- DET0514 attack-detection-strategy
023c654f-8f16-44d9-bb2b-00ff36a62af9sigma02cf536a-cf21-4876-8842-4159c8aee3ccsigma02e0b2ea-a597-428e-b04a-af6a1a403e5csigma0372e1f9-0fd2-40f7-be1b-a7b2b848fa7bsigma05296024-fe8a-4baf-8f3d-9a5f5624ceb2sigma05b2aa93-1210-42c8-8d9a-2fcc13b284f5sigma071d5e5a-9cef-47ec-bc4e-a42e34d8d0edsigma07330162-dba1-4746-8121-a9647d49d297sigma07e3cb2c-0608-410d-be4b-1511cb1a0448sigma09706624-b7f6-455d-9d02-adee024cee1dsigma0a13e132-651d-11eb-ae93-0242ac130002sigma0cb8d736-995d-4ce7-a31e-1e8d452a1459sigma0eb46774-f1ab-4a74-8238-1155855f2263sigma0f017df3-8f5a-414f-ad6b-24aff1128278sigma0fdc7c7f-c690-4217-9ae3-31f5156eed72sigma100ef69e-3327-481c-8e5c-6d80d9507556sigma10ac0730-c24e-4f4c-81f8-b13a1ac95a1dsigma115fdba9-f017-42e6-84cf-d5573bf2ddf8sigma121b25f7-b9d6-4b37-afa0-cba317ec52f3sigma12f6b752-042d-483e-bf9c-915a6d06ad75sigma1321dc4e-a1fe-481d-a016-52c45f0c8b4fsigma14c71865-6cd3-44ae-adaa-1db923fae5f2sigma160d2780-31f7-4922-8b3a-efce30e63e96sigma166e9c50-8cd9-44af-815d-d1f0c0e90ddesigma16ab6143-510a-44e2-a615-bdb80b8317fcsigma17769c90-230e-488b-a463-e05c08e9d48fsigma17ce9373-2163-4a2c-90ba-f91e9ef7a8c1sigma17e53739-a1fc-4a62-b1b9-87711c2d5e44sigma18b042f0-2ecd-4b6e-9f8d-aa7a7e7de781sigma1a4bd6af-99ac-4466-b5b2-7b72b4a05462sigma1c373b6d-76ce-4553-997d-8c1da9a6b5f5sigma1c722651-254a-4b04-a9f4-99b62a2d0a1fsigma1e8a9b4d-3c2a-4f9b-8d1e-7c6a5b4f3d2esigma1ec65a5f-9473-4f12-97da-622044d6df21sigma1f0b4cac-9c81-41f4-95d0-8475ff46b3e2sigma1f1d8209-636e-4c6c-a137-781cca8b82f9sigma21541900-27a9-4454-9c4c-3f0a4240344asigma22154f0e-5132-4a54-aa78-cc62f6def531sigma- … and 195 more in the database
Tested by 127
0208ea60-98f1-4e8c-8052-930dce8f742catomic03013b4b-01db-437d-909b-1fdaa5010ee8atomic07f43b33-1e15-4e99-be70-bc094157c849atomic091a6290-cd29-41cb-81ea-b12f133c66cbatomic0b19f4ee-de90-4059-88cb-63c800c683edatomic0e7b8a4b-2ca5-4743-a9f9-96051abb6e50atomic110b4281-43fe-405f-a184-5d8eaf228ebfatomic1174b5df-2c33-490f-8854-f5eb80c907caatomic11cb8ee1-97fb-4960-8587-69b8388ee9d9atomic11e65d8d-e7e4-470e-a3ff-82bc56ad938eatomic12e5551c-8d5c-408e-b3e4-63f53b03379fatomic13f09b91-c953-438e-845b-b585e51cac9batomic14033063-ee04-4eaf-8f5d-ba07ca7a097catomic1602ff76-ed7f-4c94-b550-2f727b4782d4atomic17538258-5699-4ff1-92d1-5ac9b0dc21f5atomic19c07a45-452d-4620-90ed-4c34fffbe758atomic1b3e0146-a1e5-4c5c-89fb-1bb2ffe8fc45atomic1b682d84-f075-4f93-9a89-8a8de19ffd6eatomic1c9ef3e6-bde6-402c-83bc-d89ea8bfd372atomic1cac9b54-810e-495c-8aac-989e0076583batomic1ee572f3-056c-4632-a7fc-7e7c42b1543catomic1f6743da-6ecc-4a93-b03f-dc357e4b313fatomic212cfbcf-4770-4980-bc21-303e37abd0e3atomic22d89a2f-d475-4895-b2d4-68626d49c029atomic23b88394-091b-4968-a42d-fb8076992443atomic24a12b91-05a7-4deb-8d7f-035fa98591bcatomic2a821573-fb3f-4e71-92c3-daac7432f053atomic315f4be6-2240-4552-b3e1-d1047f5eeceaatomic33a29ab1-cabb-407f-9448-269041bf2856atomic33ca84bc-4259-4943-bd36-4655dc420932atomic369878c6-fb04-48d6-8fc2-da9d97b3e054atomic3d47daaa-2f56-43e0-94cc-caf5d8d52a68atomic3ddf3d03-f5d6-462a-ad76-2c5ff7b6d741atomic40074085-dbc8-492b-90a3-11bcfc52fda8atomic40075d5f-3a70-4c66-9125-f72bee87247datomic41ac52ba-5d5e-40c0-b267-573ed90489bdatomic45ad4abd-19bd-4c5f-a687-41f3eee8d8c2atomic4608bc1b-e682-466b-a7d7-dbd76760db31atomic4b841aa1-0d05-4b32-bbe7-7564346e7c76atomic4ce786f8-e601-44b5-bfae-9ebb15a7d1c8atomic- … and 87 more in the database
Lab findings
Measured in the isolated detection lab (Wazuh / Sysmon / auditd). Each run detonates a benign emulation of the technique and grades what the SIEM saw.
| Run | Outcome | Tool | Platform | Ran at |
|---|---|---|---|---|
run-2026-10-20-014 | failed | atomic | windows | 2026-10-20 |
run-2026-11-02-021 | detected | atomic | windows | 2026-11-02 |
run-2026-10-20-014— Backlog detectability-baseline probe (priority 5, 1 corpus attack(s); atomic_tests=78). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1685 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=0 incidental=0 max_level=0 dwell_s=90run-2026-11-02-021— Backlog detectability-baseline probe (priority 5, 1 corpus attack(s); atomic_tests=78). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1685 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=1 incidental=36 max_level=15 dwell_s=90
Framework references
- Primary source: https://thehackernews.com/2026/03/54-edr-killers-use-byovd-to-exploit-34.html
- attack: T1068 (primary)
- attack: T1685
Evidence & sources
- ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Physical, insider and cross-cutting attacks' table, line 689 of Cyber-Attack-Taxonomy.md
- ev-0002 (Seeded-record enrichment run 2026-09-30 (crosswalk + facet classification)) — Crosswalk to attack:T1068, attack:T1685 as the nearest framework entries; ids verified to exist in the cached catalogues.
- ev-0003 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 128 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
- ev-0004 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 43 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
- ev-0005 (Phase 4 detection lab - detonation runs 2026-10-20) — Lab detonation run-2026-10-20-014 (failed) for T1685: no alert matched the expected technique
- ev-0006 (Phase 4 detection lab - detonation runs 2026-11-02) — Lab detonation run-2026-11-02-021 (detected) for T1685: no alert matched the expected technique