BYOTC means Bring Your Own Trusted Caller. It is a Windows abuse pattern where an attacker uses a legitimate user-mode application that a privileged driver already trusts, then passes requests through that app to reach dangerous kernel functionality. The driver may be signed and correctly loaded, but its internal authorization logic can still be too permissive.
This matters because security teams often focus on blocking malicious drivers, while BYOTC targets the trust boundary inside the driver itself. If a driver accepts commands from a “trusted” client without strong validation, an attacker can abuse that path for privilege escalation, kernel memory manipulation, or security bypass. Defenses include strict driver design, least-privilege interfaces, driver blocklists, HVCI or Memory Integrity, and application control that limits which processes can interact with sensitive components.