# Abused signed kernel driver loading

Signed drivers in user-writable paths or revoked certs granting process kill or raw disk IOCTLs

_Area: Memory corruption and native code. Seen in 3 disclosed reports; latest 2025-11-15. Updated 2026-11-03._

## How it works
Windows loads a kernel driver because it carries a valid signature, not because of who shipped it, where the file sits, or whether the certificate is still trusted. Two assumptions break. First, a signature proves the binary was signed once; a wiper signed by a revoked Hermetica Digital certificate still loaded [E2](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-elastic-protects-against-data-wiper-malware-targeting-ukraine-hermeticwiper.md). Second, a legitimately signed driver that exposes powerful IOCTLs (kill any PID, raw sector read/write) becomes a primitive any local admin can drive from user mode, bypassing OS protections [E1](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-roningloader.md)[E2](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-elastic-protects-against-data-wiper-malware-targeting-ukraine-hermeticwiper.md)[E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-readtext34-ransomware-incident.md). The loader accepts the driver; the driver does the damage.

## Where it shows up
- Kernel service creation (`sc create ... type=kernel`) pointing at a driver in a user-writable or temp folder [E1](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-roningloader.md)[E2](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-elastic-protects-against-data-wiper-malware-targeting-ukraine-hermeticwiper.md)[E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-readtext34-ransomware-incident.md)
- Drivers embedded as compressed resources inside an installer or wiper binary (mscompress) [E2](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-elastic-protects-against-data-wiper-malware-targeting-ukraine-hermeticwiper.md)
- Short-lived driver services followed by IOCTL calls that terminate processes [E1](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-roningloader.md)
- Signatures from obscure or revoked CAs (e.g. Hermetica Digital) on security tooling [E2](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-elastic-protects-against-data-wiper-malware-targeting-ukraine-hermeticwiper.md)
- Legit vendor drivers (EaseUS epmntdrv.sys, Eldos RawDisk) present outside their product [E2](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-elastic-protects-against-data-wiper-malware-targeting-ukraine-hermeticwiper.md); vulnerable antirootkit drivers (truesight.sys) deployed to crash security products [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-readtext34-ransomware-incident.md)
- `bcdedit /set loadoptions DDISABLE_INTEGRITY_CHECKS` paired with driver install (review heuristic, not observed in these reports) [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-readtext34-ransomware-incident.md)

## How to review
Check the invariant: every kernel driver loaded must be signed by a currently trusted, non-revoked certificate AND reside in a path only administrators can write. For each driver, enumerate its IOCTLs and confirm none grant arbitrary process termination or raw disk access to unprivileged callers. Flag any driver service whose binary path is user-writable, temp, or embedded-extracted. Confirm integrity-check disabling is not set.

## How finders spotted it
- After a public PPL-abuse disclosure, wrote a behavioral rule for ClipUp `-ppl` execution and threat-hunted telemetry, surfacing a live campaign chaining a signed driver with IOCTL process kill [E1](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-roningloader.md)
- Malware analysis noticed a valid signature by an unfamiliar CA, embedded mscompress-compressed vendor drivers, kernel service creation, and DeviceIoControl/IOCTL usage indicating raw disk access [E2](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-elastic-protects-against-data-wiper-malware-targeting-ukraine-hermeticwiper.md)
- EDR alerts on RDP enablement, recovery disabling, and canary modification; timeline reconstruction from event logs and file artifacts showed a vulnerable antirootkit driver crashing Trend Micro before encryption [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-readtext34-ransomware-incident.md)

## Variants seen
- Signed driver exposing a kill-any-PID IOCTL (0x222000), chained with PPL abuse and WDAC policy to disable AV [E1](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-roningloader.md)
- Revoked-cert wiper embedding legitimate partition drivers for raw sector writes [E2](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-elastic-protects-against-data-wiper-malware-targeting-ukraine-hermeticwiper.md)
- Stolen-admin BYOVD with a vulnerable antirootkit driver to crash security products before encryption [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-readtext34-ransomware-incident.md)

## Impact and severity
High: kernel-level process termination and raw disk writes defeat endpoint protection and enable wipers and ransomware [E1](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-roningloader.md)[E2](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-elastic-protects-against-data-wiper-malware-targeting-ukraine-hermeticwiper.md)[E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-readtext34-ransomware-incident.md). Impact rises when chained with PPL abuse, WDAC policy, and shadow-copy deletion, giving redundant AV neutralization and recovery inhibition before payload deployment [E1](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-roningloader.md)[E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-readtext34-ransomware-incident.md).

## Seen in real software
Open-source packages and projects, and products, where this pattern was found. If the target runs one, compare the version it runs with the fix.
- **TrueSight RogueKiller Antirootkit Driver** (truesight.sys) (version not stated): ReadText34 Ransomware Incident. Report: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-readtext34-ransomware-incident.md
- **EaseUS Partition Master** (epmntdrv.sys) (version not stated): Elastic protects against data wiper malware targeting Ukraine: HERMETICWIPER. Report: https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-elastic-protects-against-data-wiper-malware-targeting-ukraine-hermeticwiper.md

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-roningloader.md
- E2: https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-elastic-protects-against-data-wiper-malware-targeting-ukraine-hermeticwiper.md
- E3: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-readtext34-ransomware-incident.md