Fake Anti-Cheat Drivers and Kernel Rootkits: BYOVD Exploits and Driver Verifier Isolation

Threat Vector Matrix: Legitimate Kernel Anti-Cheat vs Counterfeit Rootkits

Modern PC competitive titles require Ring 0 kernel-level anti-cheat drivers (e.g. vgk.sys, EasyAntiCheat.sys, bedaisy.sys). Cybercriminals exploit this paradigm by distributing pirated game installers, private cheat loaders, or community tournament clients bundling "Bring Your Own Vulnerable Driver" (BYOVD) payloads and persistent kernel rootkits.

Identifying Rogue Kernel Drivers in Windows System32

Attackers deploy rootkits directly into the Windows driver directory or register them as background system services:

1. Audit Driver Store via Command Line: Execute PowerShell to inspect all installed third-party drivers and their digital signers:

   // Inspect third-party kernel drivers and filter out non-Microsoft signers
   Get-WmiObject Win32_SystemDriver | Where-Object { $_.State -eq "Running" -and $_.PathName -notmatch "Windows\System32\drivers" } | Select-Object Name, DisplayName, PathName
   

2. Inspect Driver Digital Signatures via Sigcheck: Scan target drivers using Microsoft Sysinternals Sigcheck:

   sigcheck64.exe -v -a C:\Windows\System32\drivers\suspicious_ac.sys
   

   Look for:
   • "Signing date": Outdated timestamps (e.g. 2015-2018 drivers in a 2026 title).
   • "Revocation status": Revoked by Microsoft Root Authority.

Activating Windows Memory Integrity (HVCI) and Driver Blocklists

Hypervisor-Protected Code Integrity (HVCI) neutralizes unsigned or vulnerable drivers by enforcing hardware-enforced virtualization security:

1. Open Windows Security -> Device security -> Core isolation details.
2. Toggle Memory integrity to On.
3. Toggle Microsoft Vulnerable Driver Blocklist to On.
   • If Windows refuses to enable Memory Integrity due to an incompatible driver, note the published filename (e.g. oem_anticheat.sys).
4. Forcefully purge the incompatible driver using pnputil:

   // Enumerate and delete the offending third-party driver package
   pnputil /enum-drivers
   pnputil /delete-driver oemXX.inf /uninstall /force
   

Using Driver Verifier to Isolate Rogue Kernel Hooks

// PowerShell helper to inspect active kernel service registrations
Get-Service | Where-Object { $_.ServiceType -eq "KernelDriver" -and $_.Status -eq "Running" } | Select-Object Name, DisplayName, Status

1. Press Win + R, type verifier.exe, and hit Enter.
2. Select Create standard settings -> click Next.
3. Select Select driver names from a list -> click Next.
4. Sort by Provider and select all non-Microsoft and unverified driver files.
5. Reboot Windows. If a driver executes an illegal kernel memory read, Driver Verifier crashes the system cleanly with an explicit bugcheck pointing directly to the offending .sys binary, allowing safe removal in Safe Mode.