Block abuse of exploited vulnerable signed drivers (Device)
This machine-wide registry value controls the attack surface reduction rule identified by `56a863a9-875e-4185-98a7-b882c64b5ce5`.
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules\56a863a9-875e-4185-98a7-b882c64b5ce5
This machine-wide registry value controls the attack surface reduction rule identified by 56a863a9-875e-4185-98a7-b882c64b5ce5. A DWORD value of 1 places the rule in Block mode.
The rule stops applications from saving signed drivers that contain known exploitable vulnerabilities to the device. Its scope is the placement of such driver files on the computer, helping prevent attackers from introducing a vulnerable driver for later exploitation.
Notes
Additional effects
Windows can display a user notification when the rule blocks an operation. Microsoft Defender identifies blocked activity from this rule with the advanced hunting action type AsrVulnerableSignedDriverBlocked. Microsoft documents the rule as not generating a dedicated Defender for Endpoint EDR alert.
Security
A local attacker with sufficient privileges can exploit a vulnerable signed driver to obtain access to the operating-system kernel. Kernel access can then be used to disable or bypass security controls and facilitate further compromise.
By preventing recognized vulnerable drivers from being written to the device, the rule reduces exposure to this “bring your own vulnerable driver” technique. It does not itself grant or revoke general administrative, file-system, or storage privileges.
Possible side effects
Legitimate software, installers, or update packages can be affected if they attempt to place a signed driver that Microsoft classifies as vulnerable on the device. The driver installation or software functionality that depends on that driver might consequently fail.
Notes
The rule does not prevent a vulnerable driver that is already present on the computer from being loaded. It therefore has a different scope from controls such as the Microsoft vulnerable driver blocklist or App Control for Business, which can prevent vulnerable drivers from loading.
Microsoft lists no rule-specific dependencies for this rule. The general ASR prerequisites still apply, including Microsoft Defender Antivirus running as the active antivirus application with real-time protection enabled.
Microsoft documentation
Microsoft Learn: ASR rules reference
Microsoft Learn: Attack surface reduction rules overview
Microsoft Learn: Windows Server 2025 machine configuration reference