The PoisonX rootkit utilizes a Bring Your Own Vulnerable Driver (BYOVD) attack vector to achieve kernel-mode execution, specifically facilitating a 0-day bypass of CrowdStrike EDR. By deploying legitimate but vulnerable drivers, the threat actor escalates privileges from user-mode to kernel-mode, enabling the manipulation of OS structures to blind endpoint detection capabilities. Currently, the campaign is highly targeted toward organizations within Japan. Successful mitigation requires identifying the loading of known vulnerable drivers and implementing kernel-level monitoring to detect unauthorized driver manipulation and EDR neutralization attempts.

• Attack Vector & Methodology

  • Leverages Bring Your Own Vulnerable Driver (BYOVD) to bypass driver signature enforcement.
  • Facilitates rapid privilege escalation from user-mode to kernel-mode.
  • Employs weaponized legitimate drivers to introduce exploitable vulnerabilities into the kernel space.

• EDR Neutralization & Technical Deep Dive

  • Demonstrated a successful 0-day bypass of CrowdStrike EDR capabilities.
  • Utilizes kernel-mode exploitation primitives to manipulate OS components and blind security telemetry.
  • Ghidra reverse engineering reveals complex kernel-mode operations designed for total EDR subversion.

• Campaign Profile & Geographic Targeting

  • High concentration of malicious activity targeting organizations in Japan.
  • Indicates a sophisticated, targeted campaign rather than widespread opportunistic infection.
  • Focuses on high-value targets to maximize organizational and geopolitical impact.

• Detection & Defensive Engineering

  • Deployment of Sigma rules to detect the loading of known vulnerable or malicious drivers.
  • Utilization of Loldrivers intelligence to identify and block specific vulnerable driver filenames.
  • Emphasis on monitoring for kernel-mode exploitation primitives and unauthorized driver manipulation.