{"id":13588,"date":"2021-06-30T09:08:00","date_gmt":"2021-06-30T09:08:00","guid":{"rendered":"https:\/\/nsfocusglobal.com\/?p=13588"},"modified":"2026-04-17T18:07:46","modified_gmt":"2026-04-17T18:07:46","slug":"netfilter-malicious-driver-bypasses-microsofts-signature-system","status":"publish","type":"post","link":"https:\/\/nsfocusglobal.com\/pt-br\/netfilter-malicious-driver-bypasses-microsofts-signature-system\/","title":{"rendered":"“Netfilter” malicious driver bypasses Microsoft’s signature system"},"content":{"rendered":"\n

In June 2021, German computer security solutions software company G Data Software detected a malicious driver named “Netfilter”. Unexpectedly, the malicious driver bypassed and obtained Microsoft’s file signature. When Microsoft learned about it, it immediately added the signature of the malware to the security center of the Windows system for protection, and conducted an internal investigation into the cause of the incident.
In order to improve security, Microsoft started with Windows Vista, requiring any code running in kernel mode to be tested and signed before public release to ensure the stability of the operating system. By default, drivers that have not obtained a Microsoft digital signature certificate cannot be installed.<\/p>\n\n\n\n

\"Red<\/figure>\n\n\n\n

The malicious program “Netfilter Rootkit” in this incident has external communication and self-update mechanisms, and its feature is that it can redirect IP. The IP address of the attacked target will be redirected to 45[.]248.10.244:3000.<\/p>\n\n\n\n

The method of bypassing Microsoft’s signature in this incident is not yet known. It seems that the attacker followed Microsoft’s standard procedure for submitting software programs and used “legal methods” to obtain Microsoft’s signature.<\/p>\n\n\n\n

At present, NTI has supported online detection of this incident (https:\/\/nti.nsfocus.com<\/a>), and products that have been enabled by intelligence can also obtain the corresponding IOC (continuous update) in the offline upgrade package, which can be downloaded on the upgrade site. (http:\/\/update.nsfocus.com<\/a>)<\/p>\n\n\n\n

Statement<\/h2>\n\n\n\n

This advisory is only used to describe a potential risk. NSFOCUS does not provide any commitment or promise on this advisory. NSFOCUS and the author will not bear any liability for any direct and\/or indirect consequences and losses caused by transmitting and\/or using this advisory. NSFOCUS reserves all the rights to modify and interpret this advisory. Please include this statement paragraph when reproducing or transferring this advisory. Do not modify this advisory, add\/delete any information to\/from it, or use this advisory for commercial purposes without permission from NSFOCUS.<\/p>\n<\/body><\/html>\n","protected":false},"excerpt":{"rendered":"

In June 2021, German computer security solutions software company G Data Software detected a malicious driver named “Netfilter”. Unexpectedly, the malicious driver bypassed and obtained Microsoft’s file signature. When Microsoft learned about it, it immediately added the signature of the malware to the security center of the Windows system for protection, and conducted an internal […]<\/p>\n","protected":false},"author":6,"featured_media":35787,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_coblocks_attr":"","_coblocks_dimensions":"","_coblocks_responsive_height":"","_coblocks_accordion_ie_support":"","footnotes":""},"categories":[6],"tags":[],"class_list":["post-13588","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-emergency-response"],"acf":[],"yoast_head":"\n"Netfilter" malicious driver bypasses Microsoft's signature system - NSFOCUS<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/nsfocusglobal.com\/netfilter-malicious-driver-bypasses-microsofts-signature-system\/\" \/>\n<meta property=\"og:locale\" content=\"pt_BR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\""Netfilter" malicious driver bypasses Microsoft's signature system - NSFOCUS\" \/>\n<meta property=\"og:description\" content=\"In June 2021, German computer security solutions software company G Data Software detected a malicious driver named "Netfilter". Unexpectedly, the\" \/>\n<meta property=\"og:url\" content=\"https:\/\/nsfocusglobal.com\/netfilter-malicious-driver-bypasses-microsofts-signature-system\/\" \/>\n<meta property=\"og:site_name\" content=\"NSFOCUS\" \/>\n<meta property=\"article:published_time\" content=\"2021-06-30T09:08:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-04-17T18:07:46+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2021\/06\/111.png\" \/>\n<meta name=\"author\" content=\"Jie Ji\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:title\" content=\""Netfilter" malicious driver bypasses Microsoft's signature system - NSFOCUS\" \/>\n<meta name=\"twitter:description\" content=\"In June 2021, German computer security solutions software company G Data Software detected a malicious driver named "Netfilter". Unexpectedly, the\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2021\/06\/111.png\" \/>\n<meta name=\"twitter:label1\" content=\"Escrito por\" \/>\n\t<meta name=\"twitter:data1\" content=\"Jie Ji\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. tempo de leitura\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutos\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/netfilter-malicious-driver-bypasses-microsofts-signature-system\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/netfilter-malicious-driver-bypasses-microsofts-signature-system\\\/\"},\"author\":{\"name\":\"Jie Ji\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/#\\\/schema\\\/person\\\/1077d8fcd7e52c96f17a33b63a0d157b\"},\"headline\":\"“Netfilter” malicious driver bypasses Microsoft’s signature system\",\"datePublished\":\"2021-06-30T09:08:00+00:00\",\"dateModified\":\"2026-04-17T18:07:46+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/netfilter-malicious-driver-bypasses-microsofts-signature-system\\\/\"},\"wordCount\":329,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/netfilter-malicious-driver-bypasses-microsofts-signature-system\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/nsfocusglobal.com\\\/wp-content\\\/uploads\\\/2021\\\/06\\\/111.png\",\"articleSection\":[\"Emergency Response\"],\"inLanguage\":\"pt-BR\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/nsfocusglobal.com\\\/netfilter-malicious-driver-bypasses-microsofts-signature-system\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/netfilter-malicious-driver-bypasses-microsofts-signature-system\\\/\",\"url\":\"https:\\\/\\\/nsfocusglobal.com\\\/netfilter-malicious-driver-bypasses-microsofts-signature-system\\\/\",\"name\":\"\\\"Netfilter\\\" malicious driver bypasses Microsoft's signature system - NSFOCUS\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/netfilter-malicious-driver-bypasses-microsofts-signature-system\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/netfilter-malicious-driver-bypasses-microsofts-signature-system\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/nsfocusglobal.com\\\/wp-content\\\/uploads\\\/2021\\\/06\\\/111.png\",\"datePublished\":\"2021-06-30T09:08:00+00:00\",\"dateModified\":\"2026-04-17T18:07:46+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/netfilter-malicious-driver-bypasses-microsofts-signature-system\\\/#breadcrumb\"},\"inLanguage\":\"pt-BR\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/nsfocusglobal.com\\\/netfilter-malicious-driver-bypasses-microsofts-signature-system\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"pt-BR\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/netfilter-malicious-driver-bypasses-microsofts-signature-system\\\/#primaryimage\",\"url\":\"https:\\\/\\\/nsfocusglobal.com\\\/wp-content\\\/uploads\\\/2021\\\/06\\\/111.png\",\"contentUrl\":\"https:\\\/\\\/nsfocusglobal.com\\\/wp-content\\\/uploads\\\/2021\\\/06\\\/111.png\",\"width\":455,\"height\":622,\"caption\":\"Digital signature verification with signers list.\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/netfilter-malicious-driver-bypasses-microsofts-signature-system\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/nsfocusglobal.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"“Netfilter” malicious driver bypasses Microsoft’s signature system\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/#website\",\"url\":\"https:\\\/\\\/nsfocusglobal.com\\\/\",\"name\":\"NSFOCUS\",\"description\":\"Security Made Smart and Simple\",\"publisher\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/nsfocusglobal.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"pt-BR\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/#organization\",\"name\":\"NSFOCUS\",\"url\":\"https:\\\/\\\/nsfocusglobal.com\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"pt-BR\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/nsfocusglobal.com\\\/wp-content\\\/uploads\\\/2024\\\/08\\\/logo-ns.png\",\"contentUrl\":\"https:\\\/\\\/nsfocusglobal.com\\\/wp-content\\\/uploads\\\/2024\\\/08\\\/logo-ns.png\",\"width\":248,\"height\":36,\"caption\":\"NSFOCUS\"},\"image\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/#\\\/schema\\\/person\\\/1077d8fcd7e52c96f17a33b63a0d157b\",\"name\":\"Jie Ji\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"pt-BR\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/61cb438513c138ce3f1f49e3485f113a0215220de5e284a2bd4e85358f6c8d02?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/61cb438513c138ce3f1f49e3485f113a0215220de5e284a2bd4e85358f6c8d02?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/61cb438513c138ce3f1f49e3485f113a0215220de5e284a2bd4e85358f6c8d02?s=96&d=mm&r=g\",\"caption\":\"Jie Ji\"},\"url\":\"https:\\\/\\\/nsfocusglobal.com\\\/pt-br\\\/author\\\/jji\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"\"Netfilter\" malicious driver bypasses Microsoft's signature system - NSFOCUS","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/nsfocusglobal.com\/netfilter-malicious-driver-bypasses-microsofts-signature-system\/","og_locale":"pt_BR","og_type":"article","og_title":"\"Netfilter\" malicious driver bypasses Microsoft's signature system - NSFOCUS","og_description":"In June 2021, German computer security solutions software company G Data Software detected a malicious driver named \"Netfilter\". Unexpectedly, the","og_url":"https:\/\/nsfocusglobal.com\/netfilter-malicious-driver-bypasses-microsofts-signature-system\/","og_site_name":"NSFOCUS","article_published_time":"2021-06-30T09:08:00+00:00","article_modified_time":"2026-04-17T18:07:46+00:00","og_image":[{"url":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2021\/06\/111.png","type":"","width":"","height":""}],"author":"Jie Ji","twitter_card":"summary_large_image","twitter_title":"\"Netfilter\" malicious driver bypasses Microsoft's signature system - NSFOCUS","twitter_description":"In June 2021, German computer security solutions software company G Data Software detected a malicious driver named \"Netfilter\". Unexpectedly, the","twitter_image":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2021\/06\/111.png","twitter_misc":{"Escrito por":"Jie Ji","Est. tempo de leitura":"2 minutos"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/nsfocusglobal.com\/netfilter-malicious-driver-bypasses-microsofts-signature-system\/#article","isPartOf":{"@id":"https:\/\/nsfocusglobal.com\/netfilter-malicious-driver-bypasses-microsofts-signature-system\/"},"author":{"name":"Jie Ji","@id":"https:\/\/nsfocusglobal.com\/#\/schema\/person\/1077d8fcd7e52c96f17a33b63a0d157b"},"headline":"“Netfilter” malicious driver bypasses Microsoft’s signature system","datePublished":"2021-06-30T09:08:00+00:00","dateModified":"2026-04-17T18:07:46+00:00","mainEntityOfPage":{"@id":"https:\/\/nsfocusglobal.com\/netfilter-malicious-driver-bypasses-microsofts-signature-system\/"},"wordCount":329,"commentCount":0,"publisher":{"@id":"https:\/\/nsfocusglobal.com\/#organization"},"image":{"@id":"https:\/\/nsfocusglobal.com\/netfilter-malicious-driver-bypasses-microsofts-signature-system\/#primaryimage"},"thumbnailUrl":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2021\/06\/111.png","articleSection":["Emergency Response"],"inLanguage":"pt-BR","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/nsfocusglobal.com\/netfilter-malicious-driver-bypasses-microsofts-signature-system\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/nsfocusglobal.com\/netfilter-malicious-driver-bypasses-microsofts-signature-system\/","url":"https:\/\/nsfocusglobal.com\/netfilter-malicious-driver-bypasses-microsofts-signature-system\/","name":"\"Netfilter\" malicious driver bypasses Microsoft's signature system - NSFOCUS","isPartOf":{"@id":"https:\/\/nsfocusglobal.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/nsfocusglobal.com\/netfilter-malicious-driver-bypasses-microsofts-signature-system\/#primaryimage"},"image":{"@id":"https:\/\/nsfocusglobal.com\/netfilter-malicious-driver-bypasses-microsofts-signature-system\/#primaryimage"},"thumbnailUrl":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2021\/06\/111.png","datePublished":"2021-06-30T09:08:00+00:00","dateModified":"2026-04-17T18:07:46+00:00","breadcrumb":{"@id":"https:\/\/nsfocusglobal.com\/netfilter-malicious-driver-bypasses-microsofts-signature-system\/#breadcrumb"},"inLanguage":"pt-BR","potentialAction":[{"@type":"ReadAction","target":["https:\/\/nsfocusglobal.com\/netfilter-malicious-driver-bypasses-microsofts-signature-system\/"]}]},{"@type":"ImageObject","inLanguage":"pt-BR","@id":"https:\/\/nsfocusglobal.com\/netfilter-malicious-driver-bypasses-microsofts-signature-system\/#primaryimage","url":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2021\/06\/111.png","contentUrl":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2021\/06\/111.png","width":455,"height":622,"caption":"Digital signature verification with signers list."},{"@type":"BreadcrumbList","@id":"https:\/\/nsfocusglobal.com\/netfilter-malicious-driver-bypasses-microsofts-signature-system\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/nsfocusglobal.com\/"},{"@type":"ListItem","position":2,"name":"“Netfilter” malicious driver bypasses Microsoft’s signature system"}]},{"@type":"WebSite","@id":"https:\/\/nsfocusglobal.com\/#website","url":"https:\/\/nsfocusglobal.com\/","name":"NSFOCUS","description":"Security Made Smart and Simple","publisher":{"@id":"https:\/\/nsfocusglobal.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/nsfocusglobal.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"pt-BR"},{"@type":"Organization","@id":"https:\/\/nsfocusglobal.com\/#organization","name":"NSFOCUS","url":"https:\/\/nsfocusglobal.com\/","logo":{"@type":"ImageObject","inLanguage":"pt-BR","@id":"https:\/\/nsfocusglobal.com\/#\/schema\/logo\/image\/","url":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/08\/logo-ns.png","contentUrl":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/08\/logo-ns.png","width":248,"height":36,"caption":"NSFOCUS"},"image":{"@id":"https:\/\/nsfocusglobal.com\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/nsfocusglobal.com\/#\/schema\/person\/1077d8fcd7e52c96f17a33b63a0d157b","name":"Jie Ji","image":{"@type":"ImageObject","inLanguage":"pt-BR","@id":"https:\/\/secure.gravatar.com\/avatar\/61cb438513c138ce3f1f49e3485f113a0215220de5e284a2bd4e85358f6c8d02?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/61cb438513c138ce3f1f49e3485f113a0215220de5e284a2bd4e85358f6c8d02?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/61cb438513c138ce3f1f49e3485f113a0215220de5e284a2bd4e85358f6c8d02?s=96&d=mm&r=g","caption":"Jie Ji"},"url":"https:\/\/nsfocusglobal.com\/pt-br\/author\/jji\/"}]}},"_links":{"self":[{"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/posts\/13588","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/comments?post=13588"}],"version-history":[{"count":0,"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/posts\/13588\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/media\/35787"}],"wp:attachment":[{"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/media?parent=13588"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/categories?post=13588"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/tags?post=13588"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}