Driver abuse is the misuse of a legitimate driver, often a signed or vulnerable one, to perform actions that normal user-mode malware cannot. Attackers may load a driver to access kernel-level functions, weaken security controls, terminate protected processes, or change memory and system state with higher privileges.
This matters because drivers are trusted components in many systems, so abusing them can help malware bypass defenses and reduce visibility. In real attacks, driver abuse often appears as "bring your own vulnerable driver" behavior: the operator installs an old or flawed driver and uses it to disable endpoint protection or interfere with monitoring. Defenders respond by blocking known-bad drivers, enforcing driver allowlists, monitoring unusual driver installation, and watching for signs that security tools are being tampered with.