SYSTEM AND METHOD FOR BLOCKING MALICIOUS ACTIVITY OF LEGITIMATE DRIVERS Russian patent published in 2025 - IPC G06F21/56 

FIELD: information technology.

SUBSTANCE: invention relates to information technology, and more specifically to systems and methods for blocking malicious activity of legitimate drivers. Technical result is achieved using the proposed solution designed to block malicious activity of legitimate drivers. According to version of implementation, method of blocking malicious activity of legitimate drivers in operating system (hereinafter referred to as OS) is used, made with possibility of implementation of steps, according to which: collecting information on protected objects and information on drivers loaded in OS; detecting at least one legitimate driver loaded into the OS by means of information on drivers loaded in the OS and rules for detecting malicious activity from the rules database; using at least one of the following types of interception of calls of detected legitimate drivers: interception of IAT; interception of IOCTL; intercepted calls of detected legitimate drivers directed to protected objects are blocked based on collected information on protected objects and rules for detecting malicious activity.

EFFECT: higher security of the operating system.

18 cl, 6 dwg