Elastic Defend Update: Automated BYOVD Defense with 800+ Vulnerable Driver Rules

In the evolving landscape of 2026, Bring Your Own Vulnerable Driver (BYOVD) attacks remain a preferred vector for sophisticated threat actors and ransomware crews. By loading legitimate, yet signed, drivers with known vulnerabilities, adversaries can disable security controls and execute code in kernel mode. Security Arsenal has monitored this trend closely, and today's update from Elastic Security represents a significant leap forward in automated defense.

Elastic Defend has released a critical update introducing automated generation and deployment of YARA rules for over 800 vulnerable drivers. By ingesting intelligence directly from VirusTotal, LOLDrivers, and Microsoft’s vulnerable driver blocklist, Elastic is effectively closing the detection gap that BYOVD attacks depend on. This release also introduces a new troubleshooting skill for Elastic Security Assistant and expands protection coverage to ARM endpoints.

Technical Analysis

The BYOVD Threat Vector

BYOVD attacks exploit the trust placed in signed drivers. Attackers load a driver—often years old—that has a known security flaw (e.g., arbitrary memory read/write). Once loaded, the driver is used to terminate Endpoint Detection and Response (EDR) processes or disable kernel callbacks, effectively blinding the defender. The challenge for security operations has been the speed at which new drivers are identified as vulnerable versus the speed at which vendors can update detection logic.

Elastic's Automated Defense Mechanism

This update automates the "identify-to-protect" workflow:

Intelligence Ingestion: Elastic Defend continuously ingests data on vulnerable drivers from three primary sources:
- VirusTotal Intelligence: Aggregates global telemetry on suspicious driver files.
- LOLDrivers: A community-driven project cataloguing known vulnerable drivers.
- Microsoft Blocklist: The official list of drivers banned by Microsoft via HVCI (Hypervisor-protected Code Integrity).
YARA Rule Generation: The system automatically converts this intelligence into YARA rules tailored for specific driver signatures and behaviors.
Instant Deployment: These rules are pushed instantly to Elastic Defend agents without requiring manual policy updates or agent restarts, ensuring immediate protection against emerging BYOVD attempts.

Platform Expansion

ARM Support: With the proliferation of ARM-based architecture in enterprise environments, this update extends full endpoint protection capabilities to ARM devices, ensuring parity with x64/x86 defenses.
Troubleshooting Skill: A new natural language processing skill has been added to the Elastic Security Assistant, allowing analysts to query and resolve agent configuration issues via conversational prompts, reducing Mean Time to Remediation (MTTR).

Detection & Response

While Elastic Defend now handles the heavy lifting of YARA detection, security teams must maintain visibility into driver load events across the environment. The following detection logic helps identify the mechanism of driver loading (a technique often observed in BYOVD chains) and allows for hunting high-risk drivers.

SIGMA Rules

YAML

---
title: Potential BYOVD Driver Load via Service Creation
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects the creation of a kernel-mode driver service using sc.exe or PowerShell, a common technique in BYOVD attacks to load vulnerable drivers.
references:
  - https://www.elastic.co/security-labs/vulnerable-driver-detection-elastic-defend-byovd
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  category: process_creation
  product: windows
detection:
  selection_sc:
    Image|endswith: '\sc.exe'
    CommandLine|contains: 'create'
    CommandLine|contains: 'type= kernel'
  selection_powershell:
    Image|endswith: '\powershell.exe'
    CommandLine|contains: 'New-Service'
    CommandLine|contains: 'kernel'
  condition: 1 of selection_
falsepositives:
  - Legitimate installation of hardware drivers or software requiring kernel components.
level: high
---
title: Load of Known Vulnerable LOLDrivers
id: 2b3c4d5e-6f7a-8b9c-0d1e-2f3a4b5c6d7e
status: experimental
description: Detects the loading of kernel drivers historically associated with BYOVD exploitation (e.g., RTCore, Enigma). Elastic Defend 2026 automates this via YARA, but this rule provides legacy/log correlation coverage.
references:
  - https://www.elastic.co/security-labs/vulnerable-driver-detection-elastic-defend-byovd
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  category: driver_load
  product: windows
detection:
  selection:
    ImageLoaded|contains:
      - 'rtcore64.sys'
      - 'asusgio64.sys'
      - 'dbk_64.sys'
      - 'enigma64.sys'
      - 'msio64.sys'
  condition: selection
falsepositives:
  - Legitimate use of hardware debugging tools or RGB control software (rare in enterprise servers).
level: critical

KQL (Microsoft Sentinel / Defender)

This query hunts for driver load events, specifically filtering for drivers loaded from user-writable paths—a technique often used to bypass integrity checks or load unsigned variants.

KQL — Microsoft Sentinel / Defender

DeviceEvents
| where ActionType == "DriverLoad"
| extend FilePath = tostring(FolderPath) + "\" + tostring(FileName)
| where FilePath matches regex @"C:\Users\.+\AppData\|C:\ProgramData\.+\|C:\Temp\"
| project Timestamp, DeviceName, InitiatingProcessAccountName, FilePath, SHA256, SignedStatus
| order by Timestamp desc

Velociraptor VQL

Hunt for the presence of specific high-risk driver files on the disk that may not yet be loaded, enabling pre-emptive remediation.

VQL — Velociraptor

-- Hunt for known vulnerable driver files on disk
SELECT FullPath, Size, Mtime, Atime
FROM glob(globs="C:\Windows\System32\drivers\**\*.sys")
WHERE Name =~ "rtcore"
   OR Name =~ "enigma"
   OR Name =~ "dbk_"
   OR Name =~ "asusgio"

Remediation Script (PowerShell)

This script verifies the status of the Windows Vulnerable Driver Blocklist (a complementary control to Elastic's new feature) and ensures the Elastic Agent is running the latest policy version.

PowerShell

# Audit Vulnerable Driver Blocklist and Elastic Agent Status

# Check if HVCI (Hypervisor Protected Code Integrity) is enabled
# This utilizes the Microsoft Blocklist mentioned in the update
$CiConfig = Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard
Write-Host "--- HVCI / Vulnerable Driver Blocklist Status ---"
if ($CiConfig.SecurityServicesConfig -contains 1) {
    Write-Host "[+] HVCI is Enabled: Vulnerable Driver Blocklist is active." -ForegroundColor Green
} else {
    Write-Host "[-] HVCI is Disabled: Consider enabling for BYOVD protection." -ForegroundColor Red
}

# Check Elastic Defend Service Status
Write-Host "\n--- Elastic Defend Agent Status ---"
$elasticService = Get-Service -Name "Elastic Agent" -ErrorAction SilentlyContinue

if ($elasticService) {
    Write-Host "[+] Service: $($elasticService.Name)"
    Write-Host "[+] Status: $($elasticService.Status)"
    
    # Note: Actual policy version check requires querying Elastic API or local agent state file
    # This is a placeholder for the operational check
    Write-Host "[!] Verify 'Vulnerable Driver Detection' feature is enabled in Kibana Fleet Policy."
} else {
    Write-Host "[-] Elastic Agent service not found." -ForegroundColor Red
}

Remediation

Update Elastic Defend: Ensure all endpoints are updated to the latest version of Elastic Defend that supports the automated vulnerable driver detection capability.
Policy Activation: Navigate to the Elastic Fleet console and verify that the "Vulnerable Driver Detection" integration is enabled within your agent policies. No additional configuration is required for the rules to download from VirusTotal/LOLDrivers, but the feature must be active.
Complementary Hardening: While Elastic Defend blocks the execution of these drivers, configure Windows Defender Application Control (WDAC) and enable HVCI (Memory Integrity) on supported endpoints. This provides a second layer of enforcement by leveraging Microsoft's blocklist directly at the OS level.
Incident Review: If an alert is triggered for a vulnerable driver:
- Isolate the host immediately.
- Investigate the parent process that initiated the driver load (often a command shell, installer, or payload dropper).
- Check for evidence of EDR tampering or termination attempts.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub