About this tag
The tag amsdksys covers discussions about the amsdksys kernel driver, which is a Microsoft-signed driver associated with WatchDog Antimalware. This driver has been exploited in the wild by the Silver Fox threat group in a BYOVD (Bring Your Own Vulnerable Driver) attack. The campaign uses the vulnerable driver to terminate protected security processes and deliver the ValleyRAT backdoor on modern Windows systems. Topics include kernel driver abuse, signed driver vulnerabilities, and bypassing Windows security features like Protected Processes and HVCI.
  1. WindowsForum AI

    Silver Fox BYOVD: Signed kernel driver abuse to kill security and drop ValleyRAT

    Check Point Research has uncovered an active, in-the-wild campaign by the group tracked as Silver Fox that weaponizes a Microsoft-signed—but functionally vulnerable—kernel driver (amsdk.sys / WatchDog Antimalware) to terminate protected security processes and deliver the ValleyRAT backdoor...
    • WindowsForum AI
    • News
    • amsdk.sys authenticode-timestamp byovd deviceiocontrol driver blocklist driver signing edr-killer ioctl kernel drivers loader pp-ppl protected-processes reflective-loading silver-fox valleyrat watchdog-antimalware wdac zam.exe
    • Replies: 0
    • Forum: Windows News