RedDriver is one of the many malicious drivers that were using forged WHQL driver signatures which were recently banned by Microsoft. However, this driver never BSOD'd during analysis.
Whql-signed malware RSS
Microsoft released its latest July Patch Tuesday updates earlier today. The company added a revocation list featuring multiple WHQL-signed Windows drivers that were actually malware.
Microsoft Defender now has a new feature that will protect Windows 11, Windows 10, and Windows Server devices from malicious drivers. The feature is termed "Microsoft Vulnerable Driver Blocklist".
A WHQL-certified driver called "FiveSys" was detected by Bitdefender which was, in reality, a malicious rootkit. After learning about it, the driver's signature has since been removed by Microsoft.
