echo_driver.sys

echo_driver.sys is the kernel driver of Echo (echo.ac), a commercial anti-cheat and screenshare-scanning tool from Inspect Element Ltd. that game communities, notably Minecraft PvP and RustGameRustOpen plate → servers, use to help admins detect cheating tools on a player's machine. It is a real, signed commercial product.

It earns a place on the blocklist for a reason this section keeps meeting: the anti-cheat tool itself became the vulnerability. Security researchers (the 'EchOh-No!' writeup by 'Protocol,' with kite03 and Lemon) found that vulnerable versions had weak access controls allowing privilege escalation, which made the driver a bring-your-own-vulnerable-driver candidate. The flaw is tracked as CVE-2023-38817 and affects Echo versions below 5.2.1.0.

Microsoft added the driver to its Vulnerable Driver Blocklist and the signing certificate was revoked. It is the same shape as the Capcom story: a driver built to police cheating that, in a vulnerable build, became a way to attack the system it ran on.

If you play on a community that uses Echo, a current version may be present legitimately. A vulnerable older echo_driver.sys outside that context is the thing to look at.

echo_driver.sys is listed as a known-vulnerable driver on the public LOLDrivers project. One distinct binary hash matching this filename is on record.