EXPLOITING TRUST: HOW SIGNED KERNEL DRIVERS FUEL MODERN KERNEL LEVEL ATTACKS ON WINDOWS

Summary from the TLDR InfoSec newsletter

An emerging pattern in kernel level attacks is to use a signed kernel loader to load a signed second stage kernel driver or reflectively load an unsigned kernel driver. These signed drivers are often signed via the Windows Hardware Compatibility Program (WHCP). The WHCP requires an extended validation (EV) certificate, which is designed to increase the security of the program. However, the EV certificate application process requires little human interaction, and there are dark web sellers of EV code-signing certificates.