BlueHat Oct 23. S07: Signed, Sealed, Delivered: The Rise of Signed Malicious Drivers

### Overview In this BlueHat talk, Andrew Brandt (Principal Researcher at Sophos X-Ops) and Andreas Kluch (Senior Threat Researcher at Sophos) detail their investigation into malicious Windows kernel drivers abused in ransomware and malware campaigns. The presentation examines how threat actors transitioned from abusing legitimate, vulnerable drivers to successfully submitting malicious drivers through Microsoft's official Hardware Developer program to obtain legitimate Microsoft digital signatures.

### Key Topics - **Evolution of Kernel Abuse**: Attackers require kernel execution to disable modern endpoint detection and response (EDR) agents before ransomware deployment. Attack vectors include abusing known vulnerable legitimate drivers or obtaining valid code-signing certificates. - **Vulnerable Driver Abuse**: Threat actors leverage Bring Your Own Vulnerable Driver (BYOVD) tactics. Examples highlighted include Robinhood ransomware utilizing the vulnerable GIGABYTE driver (`gdrv.sys`) to disable Driver Signature Enforcement and execute an unsigned driver, and BlackByte ransomware abusing `RTCore64.sys` to perform arbitrary reads and writes in kernel memory to overwrite notify routine arrays (`PspCreateProcessNotifyRoutine`). - **Maliciously Signed Drivers**: Rather than relying solely on vulnerable third-party drivers or leaked certificates (such as leaked NVIDIA keys or fraudulent Chinese company certificates), attackers compromised the Microsoft Hardware Developer program pipeline to produce kernel drivers signed directly with Microsoft's Windows Hardware Compatibility certificate.

### Technical Details - **Submission Pipeline Abuse**: Submitting drivers via the Windows Hardware Developer dashboard requires an Extended Validation (EV) or Organization Validation (OV) certificate, signing a `.cab` archive containing driver files, and passing Microsoft compatibility and security checks. Attackers successfully met these conditions to produce fully signed, trusted malicious drivers. - **The EDR Killer Toolkit**: An investigation stemming from a Cuba ransomware incident revealed an EDR-killing driver paired with a loader (`steel.exe` / `z-stop`). The driver registered a symbolic link (`\??\kapc_helper_link1`) matching earlier burnt cigar / POORTRY tooling. Driven via custom IOCTLs, the driver parsed targeted process lists (such as a list containing 29 Sophos-specific processes out of 186 targets) and repeatedly terminated matched processes every 250 milliseconds. - **Packing and Obfuscation**: In an anomaly for kernel-mode code, the malicious signed drivers were heavily obfuscated with runtime commercial packers, predominantly VMProtect and Themida, concealing malicious logic from standard inspection. - **Hunting and Threat Landscape**: Telemetry and VirusTotal hunting uncovered multiple distinct malware categories carrying valid Microsoft or suspicious certificates. Beyond the POORTRY/burnt cigar variants, researchers identified: - **accpt rootkit**: An EDR killer specifically targeting Chinese anti-malware drivers. - **AFK Undead & Fsys**: Modular rootkits capable of monitoring and modifying SSL traffic and injecting browser content. - **NetFilter**: A network-monitoring sniffer rootkit that redirected traffic to external domains using domain generation algorithms (DGAs) under `.xyz` TLDs, with artifacts dating back to April 2021.

### Takeaways - **Industry Collaboration & Disclosure**: Sophos coordinated through the Microsoft Active Protections Program (MAPP) and MSRC. When initial detection signatures generated hundreds of presumed false-positive notifications from Microsoft's signed catalog, deeper analysis proved that these flagged files were indeed malicious signed drivers. - **Revocation and Remediation**: Microsoft remediated the threats across multiple updates, including Patch Tuesday advisories in late 2022 and July 2023. The incident highlighted Microsoft's use and subsequent documentation of `drivers.stl` to revoke and invalidate compromised driver certificates at scale.