Is the world of esports becoming dangerously over-commercialized? Look at what the anti-cheat driver does to your PC

How money moved anti-cheat to ring 0

For most of the 2000s, anti-cheat ran as an ordinary program. It scanned memory for known cheat signatures and checked game files. Cheat developers answered by moving their tools into the Windows kernel, where a user-mode scanner cannot see them, and later into separate hardware: PCIe cards that read game memory directly over DMA.

As the money in competitive play grew, a visible cheater in a ranked match or a broadcast tournament became a direct threat to sponsorship value. Publishers followed the cheaters down. Riot’s Vanguard loads its kernel driver, vgk.sys, when Windows boots. FACEIT’s client runs a kernel-mode anti-cheat while you play. Easy Anti-Cheat and BattlEye both rely on kernel components. These are signed drivers, accepted by Windows, running with the same privilege level as your antivirus and the operating system itself.

I want to be fair here. These drivers are not malware, and the companies behind them have real security teams. The point is narrower: the commercial pressure of esports made it normal for a game to install code at ring 0 on a machine that, in many homes, is also the family’s most powerful computer and sometimes the one used for work.

What a kernel driver is trusted to do

Code in the kernel can read and write any process’s memory, hide files, stop other security tools and intercept input. Windows has to trust a signed driver, because that is how graphics cards, storage controllers and endpoint detection products work. The trust is not about intent. It is about whether the code has bugs that let someone else borrow that power.

That is the real question for an IT administrator: how many signed kernel drivers are on this machine, who wrote them, and how quickly do they ship fixes? A typical gaming PC has drivers from the GPU vendor, the motherboard vendor’s RGB and fan utility, a peripheral suite, an overclocking tool and one or two anti-cheat systems. Each one is a small piece of attack surface with the highest possible privilege.

BYOVD: the signed driver as a weapon

“Bring Your Own Vulnerable Driver” is the attack that turns that surface into a tool. An attacker who already has administrator rights drops a legitimately signed driver with a known flaw, loads it, and uses its exposed control codes to read and write kernel memory. From there they switch off EDR callbacks, kill protected security processes and encrypt the disk without anything watching.

The cases are well documented. In 2022 ransomware operators were reported abusing mhyprot2.sys, the anti-cheat driver from the game Genshin Impact, to terminate antivirus processes, on machines that had never had the game installed. The driver was signed, so Windows loaded it. Other crews have used the MSI Afterburner driver RTCore64.sys (CVE-2019-16098, CVSS 7.8) and the Gigabyte driver gdrv.sys (CVE-2018-19320) for the same purpose.

Notice what BYOVD needs: admin rights first. The vulnerable driver is not the way in. It is the way to go dark once inside. That is why the most important control on a gaming PC is boring: the person using it every day should not be an administrator.

Hardening the gaming PC itself

• Turn on memory integrity. In Windows Security, under Device security and Core isolation, enable memory integrity (HVCI). It stops many vulnerable drivers from loading and is required for some anti-cheat systems anyway.
• Confirm the vulnerable driver blocklist is on. It sits on the same Core isolation page and is on by default in recent Windows 11 builds. Check it rather than assume it.
• Use a standard account day to day. Keep a separate admin account for installs. UAC prompts become a speed bump an attacker has to explain.
• Uninstall what you do not use. Old RGB suites, abandoned overclocking tools and anti-cheat from games you finished are drivers you no longer need.
• Log driver loads. If the machine is managed, Sysmon Event ID 6 records every driver load with its hash and signature. It is one of the alerts on our baseline rules table.

A separate VLAN for play

Hardening the PC reduces the odds. Segmentation limits the damage. The goal is that a compromised gaming PC can reach the internet and nothing else in the house, especially not the laptop that holds a VPN profile into a medical practice or a defense contractor.

Most prosumer routers and every small business firewall we deploy can do this in an afternoon. Here is the rule set we use for home offices:

Two details catch people out. First, turn off mDNS and SSDP reflection between VLANs, or the casting and discovery features will quietly bridge them. Second, segmentation is not only about packets. If the gaming PC has a browser signed in to your work Microsoft 365 account, or a password manager unlocked with your work vault, the VLAN does not matter. A kernel-level compromise reads those straight from memory. Keep work identity on work devices.

The same thinking, scaled up, is the containment map on our homepage: one lost machine should stay one lost machine.

So, over-commercialized?

From a security seat, the commercial side of esports did one specific thing: it made ring-0 software a normal part of playing a game. That is a defensible trade for a tournament platform. It is a less obvious one for a family PC that shares a network with a work laptop. You do not need to stop playing. You need memory integrity on, a standard account, a short driver list and a VLAN wall. If you want help drawing that wall for a home office or a whole team of remote staff, our engagement notes explain how we work.

Runbook takeaways

Threat

Signed-but-vulnerable kernel drivers used to blind EDR after an attacker gets admin

Detect

Sysmon Event ID 6 (DriverLoad) checked against the vulnerable driver blocklist

Prevent

Memory integrity (HVCI) on, blocklist on, daily use as a standard user

Contain

Gaming PCs and consoles on their own VLAN with no route to work devices

Never

Work passwords, password-manager vaults or VPN clients on the gaming PC