Wiki › Techniques, Tactics & Procedures (TTPs) › Privilege Escalation › Driver-Based Privilege Escalation

Driver-Based Privilege Escalation

2 min read

Jump to:

Overview

Driver-Based Privilege Escalation is a technique where adversaries exploit vulnerabilities or misconfigurations in device drivers to gain elevated system privileges. This method is typically employed after initial access to increase the attacker’s control over a compromised system, enabling further malicious activities that require higher-level permissions.

Attack Objective

Gain elevated privileges, often SYSTEM or kernel-level access
Supports the Privilege Escalation stage of the attack lifecycle
Advances the attacker’s position by bypassing security restrictions and enabling persistent or stealthy operations

How the Technique Works

Adversaries identify and exploit flaws in legitimate or malicious device drivers loaded on the target system. These drivers often operate with high privileges and direct hardware or kernel access. By leveraging vulnerabilities such as arbitrary code execution, improper input validation, or insecure driver installation, attackers execute code at elevated privilege levels, thereby escalating their access beyond that of the initial user context.

Common Methods & Variations

Exploitation of unsigned or vulnerable kernel-mode drivers on endpoints
Abuse of legitimate drivers with known security weaknesses (e.g., vulnerable IOCTL handlers)
Loading malicious or modified drivers to bypass security controls
Variants exist across on-premises endpoints and cloud-based virtual machines where drivers are present
Use of living-off-the-land drivers already installed on the system versus deploying custom or third-party drivers

Indicators of Compromise (IOCs)

Unexpected driver installation or loading events in system logs
Unusual or unauthorized access to kernel-mode components
Presence of unsigned or anomalous driver files on endpoints
System crashes or instability related to driver faults
Elevated process privileges following driver exploitation

Detection Strategies

Monitoring kernel-mode driver load and unload events via endpoint detection platforms or system event logs
Behavioral detection of anomalous driver activity or privilege changes
Correlation of driver-related events with process creation and privilege escalation alerts
Use of signature-based detection for known vulnerable or malicious drivers

Mitigation & Prevention

Enforce driver signature verification and restrict installation of unsigned drivers
Apply timely patches and updates to operating systems and drivers to remediate known vulnerabilities
Implement least privilege principles to limit user ability to install or load drivers
Use application control and device guard policies to restrict unauthorized driver execution
Regularly audit installed drivers and system configurations for anomalies

Response Considerations

Immediately isolate affected systems to prevent further privilege escalation or lateral movement
Investigate driver installation and loading history to identify the scope and timeline of exploitation
Analyze memory and system artifacts for signs of kernel-level compromise
Remove or disable malicious or vulnerable drivers and apply patches
Harden system configurations to prevent recurrence, including reviewing privilege assignments and driver policies

Related Techniques

Exploitation of Vulnerability (privilege escalation via software flaws)
Bypass User Account Control (UAC) mechanisms
Token Impersonation/Theft for privilege manipulation
Persistence via malicious driver installation

Mapping & References

MITRE ATT&CK: Privilege Escalation (T1068), specifically Driver Exploitation sub-techniques
Public advisories on vulnerable drivers and kernel exploits from security vendors and CERTs
Incident reports detailing driver-based escalation in targeted attacks

Tags: Attack Techniques Cybersecurity Device Drivers endpoint security Incident Response Kernel Exploits MITRE ATT&CK privilege escalation Threat Detection vulnerability exploitation