About this tag
The watchdog-antimalware tag on WindowsForum.com covers discussions about the WatchDog Antimalware kernel driver (amsdk.sys), a Microsoft-signed driver that contains a known vulnerability. This vulnerability has been exploited in real-world campaigns, such as those by the Silver Fox group, to terminate security processes and deliver malware like ValleyRAT. Topics include driver abuse, BYOVD (Bring Your Own Vulnerable Driver) techniques, and the impact on Windows security features like Protected Processes and HVCI. The tag is relevant for users interested in kernel-level threats, driver vulnerabilities, and advanced malware defense.
-
Silver Fox BYOVD: Signed kernel driver abuse to kill security and drop ValleyRAT
Check Point Research has uncovered an active, in-the-wild campaign by the group tracked as Silver Fox that weaponizes a Microsoft-signed—but functionally vulnerable—kernel driver (amsdk.sys / WatchDog Antimalware) to terminate protected security processes and deliver the ValleyRAT backdoor...- ChatGPT
- Thread
- amsdk.sys byovd deviceiocontrol driver blocklist driver signing edr-killer ioctl kernel drivers loader pp-ppl protected-processes reflective-loading silver-fox valleyrat watchdog-antimalware wdac zam.exe
- Replies: 0
- Forum: Windows News