New Windows Attack Hijacks Trusted Security Apps to Abuse Powerful Kernel Drivers

A new Windows attack technique called Bring Your Own Trusted Caller (BYOTC) shows how attackers can misuse trusted security applications to access powerful kernel drivers.

The technique is related to Bring Your Own Vulnerable Driver (BYOVD), where attackers install a legitimate but flawed signed driver to gain kernel-level access.

However, BYOTC does not always require a vulnerable driver. Instead, it targets a legitimate security driver that already includes sensitive features, such as terminating processes or opening protected handles.

These functions are often necessary for antivirus, endpoint detection, anti-cheat, and system-inspection tools.

To stop abuse, vendors usually allow only a trusted user-mode application to send sensitive commands to the driver. But this protection can fail if an attacker takes control of that trusted application.

In a BYOTC attack, the attacker injects code into a signed security process or abuses the way a trusted process is created.

The kernel driver sees a request from an approved client and allows it. However, the request is actually controlled by the attacker.

Trusted Apps Kernel Hijack

Researcher Xusheng Li found a BYOTC issue involving Malwarebytes’ mbamchameleon.sys driver. The driver included a legitimate feature that could terminate processes through the Windows ZwTerminateProcess function.

Before using this capability, a process had to register as trusted. The driver checked whether the calling process was signed by Malwarebytes.

This sounds secure, but the validation focused on the original executable file rather than the current state of the process.

An administrator-level attacker could launch the signed MBAM.exe application, inject a malicious DLL into it, register the modified process as trusted, and then send a command to terminate Microsoft Defender’s MsMpEng.exe process.

The driver accepted the request because it came from a signed Malwarebytes process. It could not detect that attacker-controlled code was running inside that process.

This demonstrates a key BYOTC problem: a valid digital signature proves that a file was trusted when it launched, but it does not guarantee that its running process has not been altered later.

malicious.exe
    └─ creates and modifies ─> verified HIGH instance
                                  └─ creates and modifies ─> verified MAXIMUM instance
                                                                  └─> privileged driver APIs

A second case involved System Informer and its SystemInformer.sys driver. Unlike Malwarebytes, System Informer used multiple checks to verify the integrity of client processes. It examined signed files, protected handles, untrusted module loading, debugging status, and process-creation history.

Its strongest trust level, called MAXIMUM, was required for highly privileged actions such as terminating a process, Xusheng said.

However, researchers found an “evil parent” weakness. A malicious administrator process could create a legitimate System Informer process and retain powerful creator handles. Those handles could then be used to modify the trusted child process during startup.

Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN-> Power your SOC with ANY.RUN