> ## Documentation Index
> Fetch the complete documentation index at: https://rootea.es/llms.txt
> Use this file to discover all available pages before exploring further.

# BYOVD (Bring Your Own Vulnerable Driver)

> Cargas un driver firmado pero vulnerable (RTCore64.sys, dbutil_2_3.sys, procexp152.sys, gdrv.sys) para obtener Ring 0.

# BYOVD (Bring Your Own Vulnerable Driver)

<p className="glossary-answer">Cargas un driver firmado pero vulnerable (RTCore64.sys, dbutil\_2\_3.sys, procexp152.sys, gdrv.sys) para obtener Ring 0.</p>

**Categoría:** [Red Team & Evasión](/glosario)

🎯 **Trinchera** — Cargas un driver firmado pero vulnerable
(`RTCore64.sys`, `dbutil_2_3.sys`, `procexp152.sys`,
`gdrv.sys`) para obtener Ring 0. Desde ahí matas EDR, parcheas
ETW-TI kernel, etc.

🔗 **Kill chain** — Catalog en [LOLDrivers.io](https://www.loldrivers.io/)
(917+ drivers). Cargar driver con `sc create` (necesitas SYSTEM
user-mode) → trigger IOCTL vulnerable → write arbitrary kernel.

📡 **Huella defensiva** — Microsoft Vulnerable Driver Blocklist
(HVCI / Memory Integrity) bloquea drivers conocidos. Sysmon
EID 6 (driver loaded) con hash en blocklist.

⚠️ **Falso amigo** — HVCI no es default en todos los Windows;
muchas empresas lo desactivan por compatibilidad legacy.

🛡️ **Remediación** — HVCI activo + Vulnerable Driver Blocklist
actualizada (ene-2026 versión más reciente), Smart App Control en
Windows 11.

***

← [Volver al glosario completo](/glosario)

<script type="application/ld+json">
  {`{"@context":"https://schema.org","@type":"DefinedTerm","name":"BYOVD (Bring Your Own Vulnerable Driver)","description":"Cargas un driver firmado pero vulnerable (RTCore64.sys, dbutil_2_3.sys, procexp152.sys, gdrv.sys) para obtener Ring 0.","inDefinedTermSet":{"@type":"DefinedTermSet","name":"Glosario táctico de pentesting","url":"https://rootea.es/glosario"},"url":"https://rootea.es/glosario/byovd-bring-your-own-vulnerable-driver"}`}
</script>

<script type="application/ld+json">
  {`{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Inicio","item":"https://rootea.es"},{"@type":"ListItem","position":2,"name":"Glosario táctico","item":"https://rootea.es/glosario"},{"@type":"ListItem","position":3,"name":"BYOVD (Bring Your Own Vulnerable Driver)","item":"https://rootea.es/glosario/byovd-bring-your-own-vulnerable-driver"}]}`}
</script>

*Última actualización: 2026-06-11*