Exploiting a kernel driver to bypass Defender and deploy WannaCry!

Hey guys,

I just wanted to share an interesting vulnerability that I came across during my malware research.

Evasion in usermode is no longer sufficient, as most EDRs are relying on kernel hooks to monitor the entire system. Threat actors are adapting too, and one of the most common techniques malware is using nowadays is Bring Your Own Vulnerable Driver (BYOVD).

Malware is simply piggybacking on signed but vulnerable kernel drivers to get kernel level access to tamper with protection and maybe disable it all together as we can see in my example!

The driver I dealt with exposes unprotected IOCTLs that can be accessed by any usermode application. This IOCTL code once invoked, will trigger the imported kernel function ZwTerminateProcess which can be abused to kill any target process (Microsoft Defender processes as shown in the picture ).

Note:

The vulnerability was publicly disclosed a long time ago, but the driver isn’t blocklisted by Microsoft.

https://github.com/xM0kht4r/AV-EDR-Killer