Glossary
Vulnerable driver blocklist
A Microsoft-maintained list of signed but exploitable kernel drivers that Windows refuses to load, blocking bring-your-own-vulnerable-driver attacks.
The Microsoft vulnerable driver blocklist is an App Control for Business policy listing kernel drivers that are legitimately signed but have known vulnerabilities, malicious behavior, or were used to bypass security. Windows refuses to load drivers on the list. Since the Windows 11 2022 update it is enabled by default on all devices, and (except on Windows Server 2016) it is enforced whenever memory integrity (HVCI), Smart App Control or S mode is active. The list is updated quarterly and the in-box copy is delivered through the monthly Windows updates; Microsoft also publishes the latest version as an XML policy that organisations can deploy more frequently with App Control.
In a bring-your-own-vulnerable-driver (BYOVD) attack, an administrator-level attacker loads an old, signed driver and uses its flaw to read or write kernel memory, typically to kill EDR processes. Confirm the setting "Microsoft Vulnerable Driver Blocklist" is on, deploy the current Microsoft XML policy on high-value systems, and monitor Code Integrity events 3076 (audit) and 3077 (enforced) for blocked loads.