{"id":51622,"date":"2023-04-24T21:06:18","date_gmt":"2023-04-24T21:06:18","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/how-fiends-abuse-an-out-of-date-microsoft-windows-driver-to-infect-victims\/"},"modified":"2023-04-24T21:06:18","modified_gmt":"2023-04-24T21:06:18","slug":"how-fiends-abuse-an-out-of-date-microsoft-windows-driver-to-infect-victims","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/how-fiends-abuse-an-out-of-date-microsoft-windows-driver-to-infect-victims\/","title":{"rendered":"How fiends abuse an out-of-date Microsoft Windows driver to infect victims"},"content":{"rendered":"

Ransomware spreaders have built a handy tool that abuses an out-of-date Microsoft Windows driver to disable security defenses before dropping malware into the targeted systems.<\/p>\n

This detection evasion utility, which Sophos X-Ops researchers are calling AuKill, is the latest example in a growing trend where miscreants either abuse a legitimate driver to disable, silence or otherwise get past endpoint detection and response (EDR) software on the systems \u2013 the so-called bring-your-own-vulnerable-driver (BYOVD) attack \u2013 or work to get a malicious driver that does the same digitally signed by a trusted entity and injected onto a victim’s computer.<\/p>\n

Either way, the victim’s PC is duped into trusting a privileged driver, granting an intruder low-level rights and access, which gives them the ability to side step any protections and deploy their malware. And to be clear, AuKill takes the BYOVD approach: it brings onto the PC a vulnerable Microsoft driver to exploit.<\/p>\n