Point is that it doesn't need ring 0 access to to bad stuff.

Ring 3 and Ring 0 can try to do the same bad stuff.

But the point is that in one the OS security layers or antivirus will catch it.

>But the point is that in one the OS security layers or antivirus will catch it.

Doesn't antivirus have detections for ring0 as well? Otherwise virus makers can just code their viruses to be in drivers and evade all the antiviruses.

No, antivirus can't know if a virus is running on Ring 0, it can try, but the virus can just stop the antivirus and the OS won't stop it.

At ring 0 the virus can do whatever it wants with your computer.

This wasn’t really true in decades past - there was a cat and mouse game where often it could be detected because the virus wasn’t perfect at hiding its activity and resource usage – and it’s become far less so in the era where even consumer hardware has virtualization features which allow even kernel code to be restricted. Even Windows is starting to use that to prevent malware from accessing secrets (e.g. Credential Guard) so I wouldn’t treat this as the ring0=game over situation it was in the 90s.

A more accurate phrasing is that antivirus software can positively confirm the presence of malware but it cannot on its own definitely prove the absence of ring0 malware. For that, you need an Apple-level secure boot process to give confidence that the code is running on an unmodified, unvirtualized kernel.