Vulnerable Driver Blocklist Disabled

Tim Peck@timpeck

•updated May 20, 2026•9•0•472

Detects modifications to the Windows registry that disable the Microsoft Vulnerable Driver Blocklist by setting VulnerableDriverBlocklistEnable to 0. This technique is used by threat actors, such as the PoisonX RAT, to load vulnerable drivers (BYOVD) and evade or blind EDR sensors.