Disabling security products

Disabling security products

a year ago
Anonymous $_PGtSJbg8h

https://www.bleepingcomputer.com/news/security/scattered-spider-hackers-use-old-intel-driver-to-bypass-security/

A financially motivated threat actor tracked as Scattered Spider was observed attempting to deploy Intel Ethernet diagnostics drivers in a BYOVD (Bring Your Own Vulnerable Driver) attack to evade detection from EDR (Endpoint Detection and Response) security products.

The BYOVD technique involves threat actors using a kernel-mode driver known to be vulnerable to exploits as part of their attacks to gain higher privileges in Windows.