# Signed driver IOCTL privilege escalation

Signed kernel driver exposing process-kill or file-delete IOCTLs to unprivileged callers without access checks

_Area: Memory corruption and native code. Seen in 2 disclosed reports; latest 2024-09-22. Updated 2026-10-23._

## How it works
A driver runs in kernel mode, so any operation it performs on behalf of a caller inherits kernel authority. The broken assumption is that only trusted software can reach the driver's control interface. When a signed driver accepts IOCTLs (or PPL-affecting operations) from any local caller and performs privileged actions — terminating processes, deleting files, overwriting protected binaries — without verifying who is calling or what they are allowed to do, an unprivileged or merely-Administrator attacker gains kernel-level effect through a legitimately signed component. The signature satisfies the OS loader but says nothing about the safety of the exposed interface.

## Where it shows up
- Drivers with IOCTL handlers that take a PID or file path and act on it directly, with no caller-identity or privilege check.
- Anti-cheat, antirootkit, updater, and "unlocker" drivers — the categories seen abused here [E2](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-invisible-miners-unveiling-ghostengine.md)[E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-readtext34-ransomware-incident.md).
- Service creation of short-lived kernel drivers (`sc create ... type=kernel`) alongside integrity-check tampering [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-readtext34-ransomware-incident.md).
- PPL-abuse paths: signed Windows binaries invoked with `-ppl` to overwrite protected processes [E1](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-roningloader.md).
- Process-kill or file-delete IOCTLs reachable from user mode with no ACL gating.

## How to review
For each driver, enumerate every IOCTL and PPL operation and ask: who can open this device and issue this request? The invariant that must hold is that any request causing a privileged side effect is gated on the caller's identity and privilege — the driver must not perform an action the caller could not perform itself. Check the device object's security descriptor and IRP handler for access checks; a handler that trusts the input buffer's target (PID, path) without validating the requester is unsafe. Confirm the driver is not merely signed but that its exposed surface is minimal and access-controlled.

## Variants seen
- Legitimately signed driver with a kill-arbitrary-PID IOCTL (0x222000) [E1](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-roningloader.md).
- Vulnerable Avast/IObit drivers exposing process-terminate and file-delete IOCTLs (0x7299C004, 0x222124) [E2](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-invisible-miners-unveiling-ghostengine.md).
- BYOVD antirootkit driver (truesight.sys) deployed to crash security products [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-readtext34-ransomware-incident.md).
- PPL abuse via ClipUp `-ppl` to overwrite Defender binaries [E1](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-roningloader.md).

## Impact and severity
High: enables EDR/AV termination, Defender disablement, and ransomware staging [E1](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-roningloader.md)[E2](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-invisible-miners-unveiling-ghostengine.md)[E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-readtext34-ransomware-incident.md). Severity rises when the driver is signed (bypasses driver-signing trust) and when paired with anti-recovery steps like shadow-copy deletion [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-readtext34-ransomware-incident.md).

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-roningloader.md
- E2: https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-invisible-miners-unveiling-ghostengine.md
- E3: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-readtext34-ransomware-incident.md