Introduction to Filter Drivers

What Is a Filter Driver?

A filter drive is a kernel-mode driver that attaches to an existing device or driver stack to observe, modify, or block I/O operations without owning the device itself.

Filter drivers act like middleware: they sit between the operating system and the target driver (or hardware), intercepting I/O Request Packets (IRPs) as they pass through the stack.

Unlike function drivers, which manage a device a device directly, filter drivers extend, or restrict safely and modularity.

Types of Filter Drivers

1 Device Filter Drivers

These filter drivers attach to a device stack, typically below or above the function driver. They can be used to:

• Block or restrict access to devices (e.g., USB storage)
• Monitor hardware I/O (e.g., keyboard keystrokes)
• Add policy-based behavior (e.g., allow access only during work hours)

Example: A corporate USB filter driver that disables USB write access.

2 File System Filter Drivers (Minifilters)

These attach to the file system stack (e.g., NTFS) to monitor or alter file-level operations.

They can:

• Log or block file creation, deletion, access
• Encrypt/decrypt files on the fly
• Enforce access control policies

Examples: A ransomware protection driver that blocks apps from writing .exe files to the Documents folder.

Filter Driver Positioning: Upper vs Lower

Filter drivers can be inserted into the stack at different levels, affecting what they see and how they behave.

Example: USB Stack with Filters

[ Application ]
     ↓
[ Upper Filter Driver ]
     ↓
[ USB Function Driver ]
     ↓
[ Lower Filter Driver ]
     ↓
[ USB Host Controller ]
     ↓
[ Hardware ]

When and Why to Use Filter Drivers

Filter drivers are commonly used in:

• Security: Block file writes, protect storage devices, detect keylogging
• Monitoring: Log file access, audit device I/O
• Policy Enforcement: Allow/disallow file types, enforce data loss prevention (DLP)
• Virtualization: Create virtual devices or sandbox physical hardware behavior

They offer:

• Extensibility without modifying core driver code
• Granular control over specific operations
• Minimal disruption to existing systems

Challenges of Writing Filter Drivers

While powerful, filter drivers require caution:

• IRQL management: Filtering at high IRQL levels requires non-blocking, fast operations
• Race conditions: Improper buffer handling or synchronization can cause system crashes
• Recursive I/O: Logging file writes can trigger new writes (logs), creating infinite loops
• Driver signing: All production filter drivers must be signed and use proper altitudes