August 2026 Windows Updates Crash Games via RGB Lighting Software — Detection, Workarounds, and Driver Hardening Guide

---
title: RGB Lighting Software Kernel Driver Load
title_note: Stability and BYOVD risk indicator
id: 4c2e8a91-7b3d-4f5e-9a21-6d8c0b2e4f7a
status: experimental
description: Detects load of kernel-mode drivers commonly shipped with RGB lighting and hardware monitoring suites (Corsair iCUE, ASUS Aura/Armoury Crate, MSI, Gigabyte, NZXT, SignalRGB, OpenRGB). These drivers are implicated in post-update instability and are a known bring-your-own-vulnerable-driver (BYOVD) attack surface.
references:
  - https://www.bleepingcomputer.com/news/microsoft/microsoft-blames-windows-gaming-issues-on-rgb-lighting-devices/
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/08/25
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  category: driver_load
  product: windows
detection:
  selection:
    ImageLoaded|contains:
      - 'WinRing0'
      - 'inpoutx64'
      - 'inpout32'
      - 'ene.sys'
      - 'ene_i2c'
      - 'GLCKIO'
      - 'Asusgio'
      - 'AsIO'
      - 'RTCore64'
      - 'NTIOLib'
      - 'gdrv.sys'
      - 'aginsm64'
      - 'corsairVBusDriver'
      - 'LHM-WmiProvider'
  condition: selection
falsepositives:
  - Legitimate RGB control software and hardware monitoring tools installed by end users
  - Fan control and thermal monitoring utilities (e.g., FanControl, LibreHardwareMonitor-based tools)
level: medium
---
title: Application Crash Handled by WerFault from RGB or Game Process
id: 8f1d3b56-2a9c-4e7d-b4f0-1c5e7a9d3b82
status: experimental
description: Detects Windows Error Reporting (WerFault.exe) spawning as a child of known RGB lighting control processes or game launchers, indicating the crash pattern associated with the August 2026 Windows update compatibility issue. Useful for scoping affected endpoints and measuring workaround effectiveness.
references:
  - https://www.bleepingcomputer.com/news/microsoft/microsoft-blames-windows-gaming-issues-on-rgb-lighting-devices/
author: Security Arsenal
date: 2026/08/25
logsource:
  category: process_creation
  product: windows
detection:
  selection_image:
    Image|endswith: '\WerFault.exe'
  selection_parent_rgb:
    ParentImage|endswith:
      - '\iCUE.exe'
      - '\Corsair.Service.exe'
      - '\Razer Synapse 3.exe'
      - '\RazerCentralService.exe'
      - '\ArmouryCrate.exe'
      - '\ArmouryCrate.Service.exe'
      - '\LightingService.exe'
      - '\MSI.CentralServer.exe'
      - '\CAM.exe'
      - '\lghub.exe'
      - '\lghub_agent.exe'
      - '\SignalRGB.exe'
      - '\OpenRGB.exe'
      - '\Aurora.exe'
  condition: selection_image and selection_parent_rgb
falsepositives:
  - Baseline crashes of RGB software unrelated to the update; tune by correlating with update installation date
level: low

// Part 1: Endpoints in the RGB/game crash pattern after August 2026 patching
let RgbProcesses = dynamic(["icue.exe","corsair.service.exe","razersynapse3.exe","razercentralservice.exe","armourycrate.exe","armourycrate.service.exe","lightingservice.exe","msi.centralserver.exe","cam.exe","lghub.exe","lghub_agent.exe","signalrgb.exe","openrgb.exe"]);
let PatchWindowStart = datetime(2026-08-11);
DeviceProcessEvents
| where TimeGenerated >= PatchWindowStart
| where FileName =~ "WerFault.exe"
| extend CrashingProcess = tolower(InitiatingProcessFileName)
| where CrashingProcess in (RgbProcesses)
    or InitiatingProcessFolderPath has_any ("steamapps","epic games","riot games","battle.net","gog galaxy","xboxgames")
| summarize CrashCount = count(),
            FirstCrash = min(TimeGenerated),
            LastCrash = max(TimeGenerated),
            FaultingApps = make_set(InitiatingProcessFileName, 20)
    by DeviceName, DeviceId
| where CrashCount >= 3
| order by CrashCount desc;
// Part 2: RGB / monitoring kernel driver loads (BYOVD surface + stability risk)
let RgbDrivers = dynamic(["winring0","inpoutx64","inpout32","ene.sys","ene_i2c","glckio","asusgio","asio","rtcore64","ntiolib","gdrv.sys","corsairvbusdriver"]);
DeviceEvents
| where TimeGenerated >= ago(14d)
| where ActionType has_any ("DriverLoad", "DriverInstall")
| extend DriverName = tolower(tostring(parse_json(AdditionalFields).DriverName))
| extend FileNameLower = tolower(FileName)
| where DriverName has_any (RgbDrivers) or FileNameLower has_any (RgbDrivers)
| project TimeGenerated, DeviceName, ActionType, FileName, FolderPath, DriverName, InitiatingProcessFileName, InitiatingProcessAccountName
| order by TimeGenerated desc

-- Hunt: RGB lighting software processes and kernel driver artifacts
-- Source 1: Running RGB control processes
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)(icue|corsair|synapse|razer|armoury|lightingservice|mystic|cam\.exe|lghub|signalrgb|openrgb|aurora)'

-- Source 2: Known RGB / hardware-monitoring kernel drivers on disk
SELECT FullPath, Size, Mtime AS ModifiedTime
FROM glob(globs=[
  'C:/Windows/System32/drivers/WinRing0*',
  'C:/Windows/System32/drivers/inpout*',
  'C:/Windows/System32/drivers/ene*',
  'C:/Windows/System32/drivers/GLCKIO*',
  'C:/Windows/System32/drivers/Asusgio*',
  'C:/Windows/System32/drivers/AsIO*',
  'C:/Windows/System32/drivers/RTCore64*',
  'C:/Windows/System32/drivers/NTIOLib*',
  'C:/Windows/System32/drivers/gdrv*',
  'C:/Windows/System32/drivers/*Corsair*'
])

# Security Arsenal — August 2026 RGB/Game Crash Triage and Containment
# Run elevated. Read-only inventory + optional containment via -Contain switch.
param(
    [switch]$Contain   # When set, stops and disables RGB control services as a workaround
)

$rgbServices = @('CorsairService','CorsairDeviceControlService','Razer Synapse Service',
    'Razer Game Manager Service','ArmouryCrateService','LightingService','asusgio',
    'MSI_Central_Service','CAM','LGHUBUpdaterService','SignalRGB*')
$rgbDrivers  = @('WinRing0*','inpout*','ene*','GLCKIO*','Asusgio*','AsIO*',
    'RTCore64*','NTIOLib*','gdrv*')

Write-Host "=== [1] Installed August 2026 updates ===" -ForegroundColor Cyan
Get-HotFix | Where-Object { $_.InstalledOn -ge (Get-Date '2026-08-11') } |
    Select-Object HotFixID, Description, InstalledOn | Format-Table -AutoSize
# NOTE: Identify the specific August 2026 KB via the Windows release health dashboard
# before any uninstall decision. Do not uninstall blindly.

Write-Host "=== [2] RGB control services present ===" -ForegroundColor Cyan
Get-Service | Where-Object { $s = $_.Name; $rgbServices | ForEach-Object { $s -like $_ } } |
    Select-Object Name, Status, StartType | Format-Table -AutoSize

Write-Host "=== [3] RGB / monitoring kernel drivers on disk ===" -ForegroundColor Cyan
foreach ($d in $rgbDrivers) {
    Get-ChildItem "$env:SystemRoot\System32\drivers\$d" -ErrorAction SilentlyContinue |
        Select-Object Name, Length, LastWriteTime
}

Write-Host "=== [4] Recent application crash events (RGB + games) ===" -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{ LogName='Application'; Id=1000,1001;
    StartTime=(Get-Date).AddDays(-14) } -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match '(?i)(icue|corsair|razer|synapse|armoury|lightingservice|lghub|cam\.exe|signalrgb|openrgb|\.dll)' } |
    Select-Object -First 25 TimeCreated, Id, @{N='Detail';E={ ($_.Message -split "`n")[0] }} |
    Format-Table -AutoSize

Write-Host "=== [5] Vulnerable Driver Blocklist status ===" -ForegroundColor Cyan
$ci = 'HKLM:\SYSTEM\CurrentControlSet\Control\CI\Config'
$blocklist = (Get-ItemProperty -Path $ci -Name 'VulnerableDriverBlocklistEnable' -ErrorAction SilentlyContinue).VulnerableDriverBlocklistEnable
if ($null -eq $blocklist) { Write-Host "Not explicitly configured (verify via Smart App Control / WDAC)" }
else { Write-Host "VulnerableDriverBlocklistEnable = $blocklist (1 = enabled)" }

if ($Contain) {
    Write-Host "=== [6] CONTAINMENT: Stopping RGB services (workaround, update stays installed) ===" -ForegroundColor Yellow
    Get-Service | Where-Object { $s = $_.Name; $rgbServices | ForEach-Object { $s -like $_ } } |
        ForEach-Object {
            Write-Host "Stopping and disabling: $($_.Name)"
            Stop-Service -Name $_.Name -Force -ErrorAction SilentlyContinue
            Set-Service -Name $_.Name -StartupType Disabled -ErrorAction SilentlyContinue
        }
    Write-Host "Containment applied. Re-test game launch, then re-enable once vendor fix is available." -ForegroundColor Yellow
}