In a recent security incident, attackers exploited a long-standing vulnerability in a Windows driver, originally part of the EnCase forensic toolset from 2010, to undermine modern Endpoint Detection and Response (EDR) systems. These attackers leveraged a technique known as BYOVD, or ‘Bring Your Own Vulnerable Driver,’ beginning the assault by exploiting compromised SonicWall VPN credentials. They deployed a custom binary designed specifically as an EDR killer, which loaded the signed but vulnerable driver to gain kernel-level access.
Despite the EnCase driver’s certificate having both expired in 2010 and being revoked, Windows continues to load it. This is due to legacy timestamp validation behavior and backward compatibility policies that permit pre-2015 signed drivers to bypass contemporary verification protocols. During this process, the attackers targeted 59 security processes, ensuring they were constantly terminated to effectively blind endpoint defenses.
The cyberattack’s discovery, attributed to Huntress, highlights critical gaps in Windows Driver Signature Enforcement. Huntress recommends several measures to mitigate such threats in the future. Key preventative steps include enabling Microsoft’s Vulnerable Driver Blocklist, implementing Microsoft’s Hypervisor-Protected Code Integrity (HVCI), and enforcing Multi-Factor Authentication (MFA) for remote access, particularly on VPN accounts. These actions aim to safeguard systems against similar types of sophisticated attacks, ultimately enhancing the robustness of endpoint defenses.

Collections

Attackers exploited a 2010 EnCase driver vulnerability using the BYOVD technique to disable EDR systems after compromising SonicWall VPN credentials. Windows still loads this expired and revoked driver due to legacy timestamp validation and pre-2015 backward compatibility policies. The attack targeted 59 security processes to blind endpoint defenses. Huntress recommends enabling Microsoft's Vulnerable Driver Blocklist, implementing HVCI, and enforcing MFA on VPN accounts to prevent similar attacks.

Exploiting a Decade-Old Driver Flaw to Disable Modern EDR Defenses