Steps

  1. Trigger:

    • Alert: “Vulnerable Driver Write”
    • Detection from EDR platform

  2. Identify:

    • Check if driver is gdrv.sys or another known vulnerable kernel module.
    • Validate SHA256 hash and signature status (revoked/unsigned).

  3. Containment:

    • Verify if driver was quarantined automatically.
    • If present, isolate host and block file in EDR console.
    • Stop and remove Gigabyte utilities if found.

  4. Remediation:

    • Delete driver file from system (C:\Windows\System32\drivers\gdrv.sys).
    • Apply Microsoft’s kernel blocklist and restart endpoint.
    • Confirm EDR and AV definitions are updated.

  5. Recovery:

    • Validate that driver service is not re-registered.
    • Reboot system to reload clean kernel state.

  6. Client Guidance:

    No further action needed if EDR quarantined successfully.

    Do not reinstall legacy Gigabyte software using outdated drivers.

    Keep OS and EDR driver blocklists current.