Apart from the ability to use stolen certificates to sign the malicious driver (an example of this could be Stuxnet drivers), it's also possible to disable the driver signature enforcement option using the Command Prompt, as follows:
bcdedit.exe /set testsigning on
In this case, the system will start allowing drivers to be signed with certificates that are not issued by Microsoft. This command requires administrator privileges and the machine to be restarted afterwards. However, with the help of social engineering, it's possible to trick the user into making it. Another option that used to be available was to execute the bcdedit /set nointegritychecks on command, but, currently, this option is ignored on major modern versions of Windows.
Additionally, some malware families abuse vulnerable signed drivers of legitimate products, which either have code execution vulnerabilities or vulnerabilities that allow for the modification of arbitrary...
