DriverShield - Windows Kernel Driver Security Glossary

Definitions of BYOVD, IOCTL, Authenticode, DSE, HVCI, EDR, YARA, Sigma, rootkit, bootkit, DKOM, SSDT, PatchGuard, ETW, token theft, PPL, Secure Boot, WHQL, and more kernel security terms.

Windows Kernel Driver Security Glossary

Concise definitions of BYOVD, kernel driver, IOCTL, Authenticode, EDR, CFI, DSE, HVCI, YARA, Sigma, MITRE ATT&CK, rootkit, bootkit, DKOM, SSDT, PatchGuard, ETW, token theft, PPL, Secure Boot, WHQL, and other terms used across DriverShield analyses and the broader Windows kernel security ecosystem.

BYOVD - Bring Your Own Vulnerable Driver. Attack technique loading a legitimate but flawed signed kernel driver to gain Ring-0 primitives and bypass endpoint defenses.
Kernel Driver - Ring-0 Windows binary with unrestricted access to physical memory, hardware registers, and the system call table.
IOCTL - I/O Control code. 32-bit dispatch identifier used by user mode to call into kernel drivers via DeviceIoControl.
Authenticode - Microsoft's PKCS#7 PE code-signing format containing the signer chain, signature, and timestamp.
EDR - Endpoint Detection and Response. Kernel-instrumented security software, a primary BYOVD target.
CFI - Control Flow Integrity. Compile-time mitigation restricting indirect call targets.
DSE - Driver Signature Enforcement. Windows 64-bit requirement for signed kernel drivers.
HVCI - Hypervisor-Protected Code Integrity. VBS feature enforcing W^X on kernel pages.
YARA - Pattern-matching language used to classify malware and known-vulnerable binaries.
Sigma - Generic SIEM detection format translatable into Splunk, ELK, Sentinel queries.
MITRE ATT&CK - Knowledge base of real-world adversary techniques. Driver behaviour maps to specific ATT&CK technique IDs.
BCDEdit - Boot Configuration Data Editor. Enables Test Mode or disables DSE, a prerequisite for some driver loading techniques.
Symbolic Execution - Static analysis (e.g. angr) exploring program paths with symbolic inputs to reach vulnerability conditions.
Entropy - Shannon entropy of a PE section. High values (near 8.0) often indicate compression, encryption, or packing.
Rootkit - Malware that subverts the OS to hide its presence and other artifacts, frequently from Ring 0.
Bootkit - Rootkit infecting early boot components (MBR, VBR, UEFI, bootloader) to run before the OS and survive reinstalls.
DKOM - Direct Kernel Object Manipulation. Editing in-memory kernel objects (e.g. EPROCESS) to hide processes or elevate privileges.
SSDT - System Service Descriptor Table. System-call dispatch table historically hooked by rootkits, now protected by PatchGuard.
PatchGuard - Kernel Patch Protection. Verifies kernel structure integrity on 64-bit Windows and bugchecks on unauthorized patching.
ETW - Event Tracing for Windows. Telemetry framework consumed by EDR; often blinded or disabled by adversaries to evade detection.
Token Theft - Copying the SYSTEM access token into a target EPROCESS for privilege escalation. A common BYOVD payload.
PPL - Protected Process Light. Restricts tampering with protected processes such as LSASS or EDR; BYOVD is used to strip it.
Secure Boot - UEFI feature verifying boot-stage code signatures against a trusted key database, blocking many bootkits.
WHQL - Windows Hardware Quality Labs. Microsoft's driver certification and signing program; abused drivers may still carry valid WHQL signatures.

Continue to the analysis methodology for pipeline details or the FAQ for common questions.