AFD.sys is a Windows kernel-mode driver for Winsock networking. It sits close to the operating system’s networking stack and helps manage low-level socket communication between applications and the network.
This driver matters in cyber security because kernel components run with very high privilege. A flaw in AFD.sys can let a local attacker escalate privileges, execute code in kernel context, or disrupt what the system can see and trust. In real attacks, threat actors often target kernel drivers to gain SYSTEM-level control, weaken endpoint visibility, or tamper with security tooling. Defenders treat such bugs as high priority because they can affect both network behavior and the integrity of the whole machine.