A signed driver is a Windows kernel driver that carries a valid digital signature from a trusted publisher. The signature helps the operating system and security tools verify that the code has not been altered and that it comes from an identified source. Because drivers run in kernel mode, they can access files, registry keys, memory, and hardware with much higher privileges than ordinary applications.
This matters because trust in a signature can be abused. Attackers may seek out signed but vulnerable or overly permissive drivers and use them to perform privileged actions, a pattern often called bring-your-own-vulnerable-driver. In defense, organizations monitor driver loading, enforce driver reputation and blocklists, and watch for unexpected kernel activity. A valid signature reduces suspicion, but it does not guarantee safe behavior.