BYOVD (Vulnerable Driver) × other EDR vendors Windows MiniFilter-based EDR drivers

The issue affects multiple EDR vendors

By modifying the registry to assign an EDR driver's Altitude to another MiniFilter that loads earlier, the attacker prevents the EDR driver from registering with the Filter Manager. This blocks kernel callbacks and disables telemetry. The attack requires local admin or system privileges to alter registry settings. A variant using different registry types (e.g., REG_MULTI_SZ) bypassed initial mitigations, but that bypass has since been patched.

Monitor registry modifications to HKLM\SYSTEM\CurrentControlSet\Services\<driver>\Instances for changes to the 'Altitude' value, especially for known EDR drivers. Alert on unexpected Altitude assignments or conflicts, and enforce integrity checks on driver load order configurations.