Kernel Driver Loading

On Windows, an operator with local service-management privileges can register an existing driver file as a kernel service and request that it start. A malicious driver executes in kernel mode; abusing a vulnerable signed driver can support privilege escalation or interfere with security controls. Driver loading remains subject to code-integrity policy, signing requirements, HVCI, and the vulnerable-driver blocklist. This procedure does not establish that a candidate is vulnerable, that the driver will load, or that an EDR control was bypassed.