BYOVD Attacks: How Attackers Turn Signed Drivers Against Your EDR

Threat actors favor vulnerable drivers for bypassing security controls to create a shell, execute malware, and for persistence because they run with kernel-level privileges