Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Microsoft confirmed in June 2021 that a malicious third-party Windows driver, commonly called Netfilter, had passed through the Windows Hardware Compatibility Program and received a Microsoft-backed signature. Microsoft did not say that its signing certificate had been stolen or that it intentionally signed malware. The incident showed how a malicious driver can abuse a trusted certification pipeline and appear legitimate to Windows and security tools.
Microsoft confirmed in June 2021 that a malicious third-party Windows driver, commonly called Netfilter, had passed through the Windows Hardware Compatibility Program (WHCP) and received a Microsoft-backed signature. Microsoft did not say that its signing certificate had been stolen or that it intentionally signed malware. The incident showed something more subtle and important: a malicious driver can abuse a trusted software-certification pipeline and appear more legitimate to Windows and security tools.
Microsoft later identified the relevant behavior under the detection name Trojan:Win64/Retliften. The driver could intercept network traffic, redirect connections, change proxy and Internet settings, and add root certificates without the user’s consent. Those capabilities gave it rootkit-like value: code running in the Windows kernel can operate below many ordinary security and monitoring controls.
What this incident did not mean: Microsoft did not intentionally sign a known rootkit, the WHCP signing certificate was not shown to be exposed, and every Windows computer did not automatically receive the driver. Microsoft described the activity as limited and associated with gaming environments. Installation also required administrative access or user action, making the driver primarily a post-exploitation tool rather than a universal initial-infection mechanism.
#1 Best Overall
- Get NVMe solid state performance with up to 1050MB/s read and 1000MB/s write speeds in a portable, high-capacity drive(1) (Based on internal testing; performance may be lower depending on host device & other factors. 1MB=1,000,000 bytes.)
- Up to 3-meter drop protection and IP65 water and dust resistance mean this tough drive can take a beating(3) (Previously rated for 2-meter drop protection and IP55 rating. Now qualified for the higher, stated specs.)
- Use the handy carabiner loop to secure it to your belt loop or backpack for extra peace of mind.
- Help keep private content private with the included password protection featuring 256‐bit AES hardware encryption.(3)
- Easily manage files and automatically free up space with the SanDisk Memory Zone app.(5). Non-Operating Temperature -20°C to 85°C
What happened with the Netfilter driver?
G DATA researchers initially encountered a Netfilter driver carrying a Microsoft signature and considered whether their detection might be a false positive. Further analysis identified it as a Windows Filtering Platform (WFP) application-layer enforcement callout driver. Its role included influencing network traffic and redirecting communications to an IP address in China.
G DATA reported the sample to Microsoft. Microsoft added detections to Microsoft Defender, began an internal investigation, suspended the associated developer account, and reviewed other driver submissions from that account for indicators of malware. Microsoft also shared relevant hashes and network indicators with other defenders.
Researchers found obfuscated or encoded strings in the sample and identified related samples dating back to March 2021. The public technical evidence supports describing Netfilter as a malicious kernel-mode driver with stealth and traffic-manipulation capabilities. Individual samples may differ, however; it is not safe to assume that every file carrying the Netfilter name had exactly the same functionality.
Why was a Microsoft-backed signature significant?
Windows treats driver signatures as an important part of its trust model. A driver package can be signed by a publisher or through a Microsoft Windows signing authority. A Microsoft-backed signature is a particularly strong trust signal and can make a driver appear substantially less suspicious than an unsigned file or one from an unknown publisher.
That trust signal answers a provenance question: Did the file pass through an approved signing or certification path? It does not answer the security question: Is the file harmless in this particular environment?
Rank #2
- Solid state performance with up to 800MB/s read speeds in a portable drive. (Based on internal testing; performance may be lower depending on host device, interface, usage conditions and other factors. 1MB=1,000,000 bytes.)
- Back up your content and memories on a storage solution that fits seamlessly into your mobile lifestyle.
- Take it with you on your adventures—up to two-meter drop protection means this durable drive can take a beating. (Based on internal testing.)
- Secure it to your belt loop or backpack for extra peace of mind thanks to the tough rubber hook.
- From Sandisk, a brand professional photographers trust to take on assignments.
The Netfilter incident is therefore best understood as an abuse of the signing ecosystem, not as proof that digital signatures are useless. Signatures remain valuable for verifying integrity and publisher relationships, but they must be combined with behavioral detection, reputation, installation history, network telemetry, and application-control policy. Later security research, including reporting from Mandiant, has likewise described attestation-signed malware as an abuse of trusted signing mechanisms rather than evidence that a valid signature guarantees safe behavior.
What could the Retliften driver do?
Microsoft’s threat description for Trojan:Win64/Retliften lists capabilities that go beyond an ordinary unwanted driver:
Free tools Windows power users keep installed
One-click scans. No signup required.
- Intercept network traffic: Kernel-level network filtering can observe or influence traffic before ordinary applications handle it.
- Redirect connections: The analyzed Netfilter sample redirected traffic to a remote Chinese IP address.
- Set a proxy server: Changing the system proxy can reroute browser and application traffic through infrastructure controlled by an attacker.
- Add root certificates: A malicious root certificate can allow systems or applications that trust the Windows certificate store to accept otherwise suspicious TLS connections.
- Modify Internet settings: Changes made without user consent can persist after the original installer exits and can affect later browsing or application traffic.
These capabilities explain the rootkit comparison. A rootkit is not simply any piece of malware that runs at startup; the term generally refers to software designed to maintain privileged access or conceal activity. A kernel driver has unusually broad access to Windows, so a malicious one can be harder to inspect and remove than a normal user-mode program. The exact capabilities still depend on the specific file, hash, configuration, and related components.
Was this an automatic infection for Windows users?
No. Microsoft characterized the incident as limited in impact and said it was aimed at gaming environments. The driver was also described as a post-exploitation component: an attacker generally needed administrative privileges to install it, or needed to persuade a user to approve its installation.
That distinction matters. The existence of a Microsoft-backed signature did not cause Windows to install the driver on all PCs. Instead, the signature could make the driver more credible after an attacker had already obtained sufficient access or convinced someone to install software. Once present, the driver could make investigation more difficult and could alter traffic or trust settings.
Rank #3
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
How did the driver pass Microsoft’s process?
Microsoft said the actor submitted the drivers for certification through the Windows Hardware Compatibility Program. The drivers had been built by a third party. Microsoft suspended the relevant account and reviewed other submissions for signs of malware.
Recommended Free Tools
Microsoft also stated that it found no evidence that the WHCP signing certificate had been exposed. In other words, the available account of the event is not that criminals stole Microsoft’s root certificate and signed arbitrary files with it. The more accurate explanation is that malicious third-party code entered a trusted certification or attestation path.
The public record does not establish that Microsoft knowingly approved malware or that the operation was proven to be state-sponsored. Those claims go beyond the evidence described by Microsoft and the researchers.
Microsoft’s response and the defenses that matter
Microsoft’s response included several layers:
- Adding Microsoft Defender detections for the malicious driver and related activity.
- Sharing file hashes and IP addresses with other defenders.
- Suspending the developer account associated with the submissions.
- Reviewing related driver submissions for malware indicators.
- Using Windows Update, Defender, Windows Defender Application Control (WDAC), and Attack Surface Reduction (ASR) capabilities to block malicious or vulnerable drivers.
Microsoft has also documented an ASR rule intended to block abuse of exploited vulnerable signed drivers. This is important because attackers do not always need a newly signed malicious driver; they may instead abuse a legitimately signed but vulnerable driver to reach kernel level.
Microsoft’s April 2026 security-update guidance describes additional protections for known vulnerable kernel drivers when the vulnerable-driver blocklist is enabled. Blocklist behavior and default settings can vary by Windows release, update state, hardware, and policy configuration, so administrators should verify the current Microsoft guidance for the specific Windows versions they manage rather than assuming that every installation has identical protection.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWhat Windows users and administrators should do
If Microsoft Defender or another reputable security product detects Retliften, Netfilter, or a related malicious driver, treat the alert as a potential security incident rather than as an ordinary driver-update problem.
Rank #4
- NEARLY 2X FASTER THAN OUR PREVIOUS GENERATION(8) – move 1,000 high-res photos in under 60 seconds(6) with up to 2000MB/s transfer speeds(2).
- IP65 RATING AND UP TO 3M DROP PROTECTION(3) – protects against spills and drops.
- POCKET-SIZED – fits easily in pockets and small bags.
- SPACE TO OWN YOUR AI CONTENT – speed and capacity to download your high-res clips and photo edits.
- 256-BIT AES ENCRYPTION(4) – helps keep private files secure with password protection.
For home users
- Do not allow the detected driver to run again. Disconnect the affected PC from the network if the alert indicates active compromise or suspicious outbound connections. Keep access to a trusted device available for account recovery and support.
- Update security intelligence. Update Microsoft Defender or the security product you use, then run a full scan. A current detection database is important because related samples and indicators can change.
- Follow the product’s remediation instructions. Do not manually delete random files from the Windows driver directories; an incomplete removal can leave a service, registry entry, or replacement component behind.
- Review recent software installations. Pay particular attention to unofficial game tools, cheats, cracks, launchers, driver packages, and applications installed shortly before the alert.
- Change sensitive passwords from a clean device if the computer was confirmed compromised, especially for email, banking, gaming, and password-manager accounts.
- Escalate when necessary. If the detection returns after reboot, Windows security features have been disabled, or certificate and proxy settings keep changing, use a professional incident-response or repair process. Reinstalling Windows may be safer than trying to clean a persistent kernel-level infection.
For administrators and security teams
- Capture the exact evidence. Record the file hash, path, filename, signer, certificate chain, signing timestamp, Defender detection, host identity, and alert time. A signature alone is not enough to classify the file.
- Isolate the host. Use the organization’s endpoint-containment process. Preserve relevant evidence before making destructive changes when a forensic investigation is required.
- Determine how it arrived. Review driver installation events, service creation, process creation, software deployment records, administrator logons, scheduled tasks, and the account that approved or installed the package.
- Inspect network changes. Review proxy settings, DNS and routing changes, outbound connections, firewall events, and connections to infrastructure associated with the alert.
- Inspect certificate-store modifications. Look for root certificates added around the installation time and determine whether they were authorized. Removing a certificate without documenting it can destroy useful evidence.
- Review Internet-settings and registry changes. Check for unauthorized proxy configuration and other changes affecting how applications reach the Internet.
- Check driver services and persistence. Look for newly created or modified kernel-driver services, unusual start types, unfamiliar driver files, and related loaders. Use trusted administrative and forensic tooling; do not rely only on the file’s displayed publisher.
- Apply policy controls. Confirm that Microsoft Defender protections, tamper protection, the vulnerable-driver blocklist, WDAC or another application-control policy, and relevant ASR rules are enabled and functioning on supported systems.
- Hunt for related activity. Search across endpoints for the exact hash, filenames, certificate information, destination IPs, proxy changes, certificate-store writes, and similar installation events.
- Remediate according to incident-response policy. Kernel-level malware can undermine confidence in local tools. Reimage affected systems when integrity cannot be established, then rotate credentials and validate the restored system.
A practical way to evaluate a suspicious signed driver
Use the following sequence instead of treating the signature as a yes-or-no safety verdict:
| Question | What to check | Why it matters |
|---|---|---|
| What exactly is the file? | Cryptographic hash, path, filename, version, and associated package | Names and publishers can be copied; the exact hash identifies the investigated artifact. |
| Who signed it? | Signer, certificate chain, validity, timestamp, and whether the signature is intact | A signature helps establish the approval path but does not prove benign behavior. |
| How was it installed? | Installer, process, user, administrator approval, service creation, and installation time | Unexpected privileged installation is a strong risk signal. |
| What did it do? | Network connections, proxy changes, certificate-store writes, registry changes, and process relationships | Behavior can reveal abuse even when reputation and signatures look normal. |
| Is it blocked or detected? | Defender detections, the current vulnerable-driver blocklist, WDAC policy, and ASR events | Microsoft’s controls and current intelligence may recognize the file or its behavior. |
What this incident teaches about software trust
The central lesson is not “never trust a signed driver.” It is that trust must be contextual and layered.
Kernel drivers deserve particularly strict scrutiny because they operate with privileges that ordinary applications do not have. Organizations should maintain an inventory of authorized drivers, restrict installation rights, monitor driver-service creation, and use application-control policies where operationally practical. Security teams should also monitor for unexpected changes to certificate stores, proxy settings, and outbound network paths.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →For consumers, the practical lesson is to avoid unofficial game modifications, cracks, cheat tools, and driver packages that request administrator access without a clear reason. A Microsoft-backed signature can make malicious software look credible, but it cannot turn an untrusted download source into a safe one.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Further reading on Windows rootkits
Readers who want deeper technical background can look at Rootkits: Subverting the Windows Kernel. It covers Windows kernel rootkits, covert channels, networking, and detection, making it relevant background for understanding why kernel-mode malware is difficult to analyze. It is an older technical reference, so use it for concepts and historical context—not as current remediation guidance. Check the current edition, condition, availability, and price before buying.
Windows Internals, Part 1, 7th Edition is another useful reference for understanding Windows processes, threads, memory, and system architecture. It is less directly focused on rootkits but can help explain why code running in kernel mode has such broad reach.
Bottom line
Microsoft’s 2021 Netfilter incident was a failure of trust screening in a third-party driver-certification path, not evidence that Microsoft knowingly signed malware or lost control of its root certificate. The malicious driver used a valid trust signal to make kernel-level traffic manipulation and system changes harder to spot.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Best Value
- Easily store and access 5TB of content on the go with the Seagate portable drive, a USB external hard Drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
A valid signature is evidence about origin and approval—not a guarantee of safe behavior. If a signed driver is detected, verify the exact file, isolate the system when appropriate, examine installation and network activity, check proxy and certificate changes, update security intelligence, and use current driver-blocking and application-control policies.
Frequently Asked Questions
Did Microsoft intentionally sign the Netfilter rootkit?
No. Microsoft said it found no evidence that the WHCP signing certificate was exposed. The available account is that a malicious third-party driver was submitted through the Windows Hardware Compatibility Program and received a Microsoft-backed signature.
Did the signed driver infect every Windows PC?
No. Microsoft described the activity as limited and associated with gaming environments. The driver was a post-exploitation component that generally required administrative access or user approval to install; it was not automatically installed on every Windows computer.
Can a digitally signed Windows driver still be malware?
Use the exact hash and certificate information, then review Defender detections, the current vulnerable-driver blocklist, installation history, driver services, proxy settings, certificate-store changes, and outbound connections. Do not classify a driver as safe solely because its signature is valid.
What is the Retliften or Netfilter malware?
Microsoft’s detection name for the relevant behavior is Trojan:Win64/Retliften. Netfilter is the common name used for the malicious driver family or sample discussed by researchers; capabilities can vary between individual samples.
The Bottom Line
Bottom line: Microsoft-backed signing made the Netfilter driver look trustworthy, but it did not make the malware safe. The incident involved a malicious third-party submission, not a proven stolen Microsoft certificate or an automatic infection of all Windows PCs. Treat a Retliften or related driver detection as a potential incident and investigate both the file and the system changes it made.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
