Elastic Defend Automates Detection of 800+ Vulnerable Windows Drivers
Elastic Security Labs has automated the detection of over 800 vulnerable Windows drivers, a common technique used by attackers to gain kernel-level access and bypass security measures.
Attackers are increasingly leveraging trusted, signed Windows drivers that contain known vulnerabilities to achieve kernel-level access on victim systems. This technique, often referred to as Bring Your Own Vulnerable Driver (BYOVD), allows malicious actors to tamper with system memory or disable security software, paving the way for further attacks such as ransomware deployment. While historically a tactic favored by advanced state-sponsored groups and red teams, its adoption by ransomware gangs highlights a growing trend in sophisticated attack methodologies.
To combat this evolving threat, Elastic Security Labs has implemented an automated system to continuously monitor public disclosures of vulnerable drivers. This system aggregates data from sources including VirusTotal, the LOLDrivers catalog, and Microsoft’s official Vulnerable Driver Block List. By automatically generating and deploying detection rules, Elastic aims to significantly reduce the window of opportunity for attackers.
The automated process filters out drivers already covered by Elastic and generates detection rules based on a driver's digital signature and file characteristics. This approach ensures that new threats are identified and addressed rapidly, decoupling detection coverage from traditional product release cycles. Elastic Security Labs has been providing vulnerable driver coverage for years, but this automated workflow, initiated in 2023 with 65 rules, has dramatically scaled its capabilities.
The core challenge with vulnerable drivers is the delay between public disclosure and vendor patching. Attackers are aware of a vulnerability the same day it becomes public, while vendor fixes can take weeks or months. Elastic's automated system bypasses this delay, making new detections available to customers almost immediately after a driver is flagged in one of the monitored feeds, without requiring manual updates or configuration changes.
An example of this technique's impact is seen with Avast's signed anti-rootkit driver, aswArPot.sys. This driver was exploited by attackers in both Cuba ransomware intrusions and GHOSTENGINE campaigns to terminate protected processes from the kernel. Elastic's automated rule generation ensures that such drivers are quickly identified and flagged.
Elastic Defend customers are advised to enable Elastic’s malware protection and set it to 'Prevent' mode. The system employs multiple layers of defense, including signature-based detection and validation against blocklists before drivers are allowed to load. Any driver that attempts to bypass these initial checks is flagged upon its first appearance in an environment, providing a robust defense against both known and emerging threats.
All generated detection rules are publicly available in the elastic/protections-artifacts repository. This transparency allows security teams to examine the detection logic, identify the specific driver that triggered an alert, and understand which public source initially flagged it.
In addition to enhanced driver detection, Elastic has introduced other improvements. The Elastic Agent Builder now includes automated troubleshooting capabilities for common issues like third-party antivirus conflicts and policy application failures. Furthermore, Elastic Defend now fully supports Windows on ARM devices, ensuring consistent telemetry and policy enforcement across x64 and ARM endpoints.