# Driver loaded from user-writable path

Kernel driver installed or loaded from a path an unprivileged user can write, or a revoked/expired signed driver still loading

_Area: Memory corruption and native code. Seen in 2 disclosed reports; latest 2026-02-04. Updated 2026-11-02._

## How it works
Windows trusts a kernel driver because of its signature, not because of where the file sits or whether the signature is still valid. Two assumptions break. First, Driver Signature Enforcement checks the signature chain and timestamp but not certificate revocation or expiry, so a revoked old driver still loads [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-encase-byovd-edr-killer.md). Second, an installer may verify file integrity once at startup, then later install a driver from a user-writable folder without re-checking, leaving a time gap an attacker fills by swapping the file [E2](https://bugbountylibrary.com/r/h1%3A852091.md). Either way, unprivileged code ends up running in kernel mode.

## Where it shows up
- Driver install or service creation (`sc create ... type=kernel`) pointing at a user-writable directory: temp, user profile, app data, game/streaming folders [E2](https://bugbountylibrary.com/r/h1%3A852091.md).
- Integrity check at process start, privileged install deferred to a later trigger (first stream, first use) [E2](https://bugbountylibrary.com/r/h1%3A852091.md).
- Signed drivers that are old, revoked, or from unrelated vendors (forensic, antirootkit tools) loaded on endpoints [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-encase-byovd-edr-killer.md)[E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-readtext34-ransomware-incident.md).
- `bcdedit /set loadoptions DDISABLE_INTEGRITY_CHECKS` paired with kernel service creation [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-readtext34-ransomware-incident.md).
- Driver files whose path or hash changes between check and load.

## How to review
The invariant: every driver loaded into the kernel must come from a path only administrators can write, and its integrity must be verified at the moment of load, not earlier. Check the install path's ACLs, confirm the check and the load are atomic (same file handle, re-hash right before load), and confirm revocation and expiry are enforced. For BYOVD, ask whether a revoked or expired certificate is rejected.

## How finders spotted it
- Noticed Steam checked integrity only at startup while Remote Play drivers installed later from a user-writable folder, then hypothesized a TOCTOU window [E2](https://bugbountylibrary.com/r/h1%3A852091.md).
- Correlated VPN telemetry with endpoint EDR: a denied portal login one minute before a successful auth from a different IP, then analyzed the dropped binary's wordlist-encoded payload and driver IOCTL usage [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-encase-byovd-edr-killer.md).
- Reconstructed a timeline from EDR alerts on RDP enablement, recovery disabling, and canary modification, plus event logs and file artifacts [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-readtext34-ransomware-incident.md).

## Variants seen
- Revoked but still-loadable signed driver abused to kill security processes (BYOVD) [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-encase-byovd-edr-killer.md).
- Legitimate installer loading a swappable driver from a user-writable path (TOCTOU) [E2](https://bugbountylibrary.com/r/h1%3A852091.md).
- Vulnerable antirootkit driver deployed with admin creds to crash security products before ransomware [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-readtext34-ransomware-incident.md).

## Impact and severity
Kernel-mode code execution lets attackers terminate endpoint security (59 processes in one case) [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-encase-byovd-edr-killer.md), disable protection before encryption [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-readtext34-ransomware-incident.md), or gain kernel privileges locally [E2](https://bugbountylibrary.com/r/h1%3A852091.md). Severity is high: it removes the last defensive layer and enables ransomware. Impact rises when combined with stolen VPN or admin credentials that grant the initial foothold [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-encase-byovd-edr-killer.md)[E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-readtext34-ransomware-incident.md).

## Seen in real software
Open-source packages and projects, and products, where this pattern was found. If the target runs one, compare the version it runs with the fix.
- **EnCase** (EnPortv.sys) (version not stated): They Got In Through SonicWall. Then They Tried to Kill. Report: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-encase-byovd-edr-killer.md

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-encase-byovd-edr-killer.md
- E2: https://bugbountylibrary.com/r/h1%3A852091.md
- E3: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-readtext34-ransomware-incident.md