Security

Bring Your Own Vulnerable Driver (BYOVD)

An attack technique where an attacker who already has admin access loads a legitimately signed but flawed kernel driver, then abuses the driver's bug to run code in the Windows kernel. Used to disable security tools or hide implants.

Deep dive

Learn Article

How BYOVD Attacks Use a Signed Driver to Reach the Windows Kernel

A signed driver proves who wrote the code, not that it is safe. Bring-your-own-vulnerable-driver loads a legitimate but flawed driver to get from admin access into the Windows kernel.

intermediate 5 min read

Back to glossary