Would this driver exist in user space, or in kernel space?
Kernel space.
Is it even possible for a non kernel mode driver to exist?
You can write a user-mode driver using the User-Mode Driver Framework, but that type of driver is effectively a user-mode service with access to some extra I/O functionality.
What we typically think of as a "driver" is a kernel-mode driver.
If it's that simple to load a driver in kernel mode (I'm assuming it's not) then why don't we see more malware in the form of drivers?
The first thing that NtLoadDriver() does is check that the caller's token has SeLoadDriverPrivilege, which even administrators' tokens don't have by default.
Other reasons we don't see much malware in the form of drivers:
- It's more difficult to develop (malicious) kernel-mode code than it is to develop (malicious) user-mode code. Since it's rare that a malware author would need to do something that can only be done from kernel-mode, there's usually not much value in writing a malicious driver.
- Modern versions of Windows have very strict driver-signing requirements with regard to allowing a driver to load. Getting a legitimate driver-signing certificate is not easy to do for a malware author, and once Microsoft discovers that said certificate is being used to sign malicious drivers, Microsoft will revoke the certificate and prevent all Windows installations from loading drivers signed with that certificate.
