CrowdStrike Falcon Prevents Multiple Vulnerable Driver Attacks in Real-World Intrusion

• Over the last 18 months, bring your own vulnerable driver (BYOVD) attacks have escalated significantly as adversaries attempt to bypass endpoint detection and response (EDR) products including the CrowdStrike Falcon® sensor. 
• BYOVD attacks involve an adversary writing to disk and loading a kernel driver with known vulnerabilities that is then abused to perform privileged operations. This could involve terminating security products, bypassing EDR anti-tampering protections, dumping privileged processes or other actions normally prevented by the Windows operating system or security software. 
• In early September 2024, a CrowdStrike customer experienced an intrusion where the adversary brought six vulnerable drivers in an attempt to bypass the Falcon sensor. All were detected or blocked by Falcon BYOVD protections. 
• In total, across endpoints targeted in the intrusion, the customer had 48 alerts stemming from the custom malware execution, use of vulnerable drivers and other malicious activity. 

BYOVD Background

BYOVD involves adversaries writing to disk and loading a legitimate, but vulnerable, driver to access the kernel of an operating system. This allows them to evade detection mechanisms and manipulate the system at a deep level, often bypassing protections like EDR. For the exploitation to succeed, attackers must first ensure the driver is brought on the target system. This is followed by the initiation of a privileged process to load the driver, setting the stage for further malicious activities.

Historically, code execution within the Windows kernel had virtually no restrictions, permitting unrestricted memory access. However, this landscape changed with the introduction of Microsoft's security initiatives like PatchGuard and virtualization-based security (VBS) with hypervisor-protected code integrity (HVCI), which have established new protective barriers. Nevertheless, the kernel continues to be an attractive target for malicious actors due to the powerful privileges it offers.

To safeguard the kernel, Windows 64-bit operating systems enforce a requirement that all drivers must be digitally signed to be loaded, a security measure facilitated by the Code Integrity (CI.dll) module known as Driver Signature Enforcement (DSE). This requirement significantly challenges malicious entities attempting to execute inside the kernel space, compelling them to seek alternative methods.

In response to these stringent security measures, adversaries have developed the BYOVD strategy to gain kernel access. Once the driver is in place, it becomes a target for exploitation, enabling attackers to leverage its vulnerabilities to achieve a range of malicious objectives, underscoring the ongoing cat-and-mouse game between security defenders and adversaries in the realm of kernel security. 

Some adversary objectives include:

• Reading or writing arbitrary kernel memory regions in an attempt to read encryption keys or tamper with OS features
• Disabling DSE to allow loading of unsigned malicious drivers
• Manually mapping unsigned malicious drivers
• Removing kernel callbacks to hinder the visibility of EDR products
• Tampering with protected processes or protected registry keys
• Performing destructive actions by accessing and overwriting to raw disk sectors
• Tampering with CPU model-specific registers (MSR) to control various CPU features
• Tampering with protected OS registers
• Obtaining handles to protected processes
• Hiding objects like processes, network sockets or files

Vulnerable, Weaponizable and Malicious Drivers

To aid detection development, CrowdStrike categorizes abused drivers into three classes: vulnerable, weaponizable and malicious. The former two categories fall under the BYOVD attack chain.

Vulnerable drivers are legitimate drivers with a software flaw that allows attackers to exploit them to perform actions beyond their intended functionality. For example, a flaw could include arbitrary reading and writing of kernel memory in the context of the driver. This would allow loading of a second malicious unsigned driver, bypassing Windows code signing restrictions. 

There is a key difference between vulnerable drivers and weaponizable features in drivers. While vulnerabilities are weaknesses that can be fixed with patches from vendors and updates by users, weaponizable features are built-in functionalities. These features cannot be patched away, and vendors will likely continue to offer them as part of their application.

Malicious drivers can be observed within a BYOVD attack chain, as they are often loaded by adversaries following the abuse of a vulnerable driver. Either these drivers are proxy-loaded following a vulnerable driver, or the attacker has obtained a compromised or stolen code signing certificate and directly loads the driver. Malicious drivers often deregister kernel callbacks of known EDR drivers or hide file system, network or registry activity from monitoring.

Weaponizable drivers are favored by many eCrime adversaries due to their capacity to terminate EDR processes and their low barrier to entry, as a secondary malicious driver is not needed. This was the case in the intrusion under discussion, where the attacker brought six weaponizable drivers, indicating a likely attempt to terminate the Falcon sensor. All of these drivers have public proofs of concepts (POCs) available on code sharing websites or are available via the loldrivers project.³

From an Unmanaged Host to a Domain Controller

For the intrusion in focus, the adversary initially moved via psexec.exe from an endpoint without Falcon installed to a corporate domain controller with a Falcon sensor. They performed basic reconnaissance and attempted to set the DisableRestrictedAdmin registry value to zero under the registry key HKLM\System\CurrentControlSet\Control\Lsa via PowerShell to disable Restricted Admin mode on Remote Desktop Protocol (RDP). This exposes credentials during remote connections and facilitates credential theft.

Once on the domain controller, the adversary attempted to execute malware and load vulnerable drivers for BYOVD attacks. 

BYOVD Attempt 1: TfSysMon.sys

Initially, the adversary attempted proxy execution of the malware file WatchMgrsCore.exe via wmic.exe using the command-line process call create to indirectly start the process. This execution was blocked by Falcon for suspicious execution via Windows Management Instrumentation (WMI), which appears as the parent process WmiPrvSe.exe.

The attacker then switched accounts and logged back on to the domain controller via RDP and attempted direct execution of WatchMgrsCore.exe as this user. This execution wrote the driver file TfSysMon.sys to disk and triggered BYOVD protections due to the suspicious IOCTL requests to this driver, which was masquerading as the file C:\Windows\WatchMgrsCore.sys.

TfSysMon.sys is a known vulnerable driver that has been observed being used by eCrime groups. The driver itself is from the application ThreatFire System Monitor and falls into the weaponizable class of vulnerable drivers. In this case, TfSysMon.sys can terminate protected processes — such as EDR products — via a specifically crafted IOCTL request. Falcon detected this malicious request, which was blocked, and the requesting process was killed. 

Following this attempt, the adversary attempted to execute five other unique binaries to control the TfSysMon.sys driver:

All binaries were prevented due to suspicious IOCTL requests to the TfSysMon.sys driver.

BYOVD Attempt 2: TrueSight.sys

The adversary then attempted to switch to a new driver by bringing the new binary C:\Users\Public\syscoreservice.exe. This dropped another known vulnerable driver, TrueSight.sys, masquerading as the file C:\Windows\System32\drivers\truepath.sys. This file is also classed as “weaponizable” and can be used to terminate EDR products. In this case, Falcon detected the driver and quarantined it upon write to disk, thereby denying the adversary any chance to attempt to load it.

BYOVD Attempt 3: aswArPot.sys

In between failed attempted executions of malicious PowerShell scripts, the adversary copied the well-known vulnerable driver aswArPot.sys to disk as C:\Users\Public\aswArPot.sys. This vulnerable driver was part of Avast Anti-Rootkit and contains API functions that allow termination of protected processes. It has been used by eCrime ransomware adversaries for a number of years. In this case, it was written to disk and immediately quarantined by Falcon, similar to TrueSight.sys. 

BYOVD Attempt 4: viragt64.sys

The adversary then attempted to stage further malware in a new location under C:\AU_Data\Bin. Two of these files, loader.exe and loader_protected.exe, were detected by CrowdStrike Falcon® Prevent next-gen antivirus (NGAV) and quarantined on write. 

Another unique binary was then executed by the attacker: magic.exe. Both the execution command lines and behavior of the binary magic.exe are consistent with a version of EDRKillShifter, as previously documented by Sophos.⁴ In this case, the attacker passed the password string for the loader on the command line via a -pass argument. 

This binary was executed and wrote the vulnerable driver viragt64.sys as C:\Users\<REDACTED>\AppData\Local\Temp\20240815.sys. This driver was originally part of the Vir.IT eXplorer Anti-Virus product. Over time, this driver has had a number of associated CVEs that allow arbitrary code execution in the kernel. Again, the driver was detected upon being written to disk as part of Falcon BYOVD protection and was quarantined. 

BYOVD Attempt 5: rentdrv2.sys

The adversary persisted and attempted to copy another vulnerable driver — rentdrv2.sys — to disk, masquerading as C:\AU_Data\1721289943.sys.⁵ Rentdrv2.sys is also vulnerable, with a weaponizable capability to terminate protected processes. Once again, upon being written by the explorer.exe process, Falcon quarantined the file and denied the adversary the opportunity to abuse it. 

BYOVD Attempt 6: ksapi64.sys

Approximately nine days later, the adversary returned to reattempt compromise of the customer’s network. Using a new user account, they accessed the same domain controller via RDP and wrote another vulnerable driver and five other unique binaries. Three of these binaries were detected by Falcon Prevent NGAV. The vulnerable driver was a weaponizable driver, ksapi64.sys, which is part of the Kingsoft Antivirus Security System and can be abused to kill protected processes. The driver was masquerading as C:\Users\Public\WinDAPI.sys and C:\Users\Public\WinDAPI64.sys, and it was quarantined on each write attempt. The other malicious binaries (shown in Table 2) were ineffective when executed by the attacker.

CrowdStrike Falcon Layered BYOVD Protection

Preventing BYOVD attacks starts with having a large corpus of telemetry and intelligence to identify new and emerging vulnerable drivers. CrowdStrike detection engineers analyze the wide range of intrusion data available from our CrowdStrike Falcon® Complete Next-Gen MDR service, CrowdStrike® Falcon Adversary OverWatch™ threat hunters and over one trillion weekly events from our customers to identify new and suspicious drivers that warrant further investigation. 

These drivers of interest are analyzed by a dedicated team of reverse engineers who specialize in vulnerable drivers. This team has analyzed thousands of drivers that could be used in BYOVD attacks to provide extensive protection beyond publicly known drivers. 

From this work, CrowdStrike Falcon implements layered protection against BYOVD threats. Once a driver is proven to be vulnerable, varied and overlapping detections are created to detect their abuse. This can cover suspicious driver loading, kernel service registration, driver-written events or IOCTL usage. This ensures even unknown drivers can be detected through their behavioral characteristics and overlapping protection is provided. 

Recommended Prevention Settings

For the most comprehensive BYOVD coverage, customers should enable “Suspicious Process Prevention,” “Additional User Mode Data Visibility,” “Driver Load Prevention” and “Vulnerable Driver Protection.” All require a Falcon Prevent subscription and sensor version 7.05 or higher.

Indicators of Compromise

Observed Malware

Written Vulnerable Drivers

Endnotes

1. IOCTLs are special codes used in input request rackets (IRPs) to enable communication between user mode processes and kernel device drivers. They provide a standardized way for applications to request specific actions from devices, such as reading or writing data, controlling device settings, or retrieving device information.

2. Available at https://github.com/gentilkiwi/mimikatz.

3. loldrivers is an open-source repository for known vulnerable drivers that could be used in BYOVD attacks, available at https://www.loldrivers.io/.

4. See https://news.sophos.com/en-us/2024/08/14/edr-kill-shifter/.

5. The file was copied to disk via explorer.exe but has a file name consistent with it being part of EDRKillShifter malware. The file name corresponds to a UNIX timestamp of 18 July 2024 08:05:43 UTC.