A minifilter driver is a kernel-mode file-system component that sits in the I/O path and can inspect, modify, allow, or block file-related operations before they complete. In Windows, minifilters are commonly used for security products, encryption tools, backup software, and cloud-sync features because they need deep visibility into reads, writes, deletes, and metadata changes.
From a security perspective, minifilters matter because they run close to the operating system’s trust boundary. A flaw in a minifilter can become a powerful local privilege-escalation or tampering path, especially if untrusted user input reaches kernel code. Attackers may abuse vulnerable filters to gain higher privileges, hide activity, or interfere with security tooling. Defenders, on the other hand, monitor these drivers carefully, limit their attack surface, and treat kernel-mode file-system components as high-value targets for patching, code review, and hardening.