examples:

• description: "Load the kernel driver" command: "sc.exe create 927e3aef03a8355d236230cace376b3023480a40c5ac08453c07dab343dd1f11 binPath=C:\\windows\\temp\\927e3aef03a8355d236230cace376b3023480a40c5ac08453c07dab343dd1f11 type=kernel && sc.exe start 927e3aef03a8355d236230cace376b3023480a40c5ac08453c07dab343dd1f11"
• description: "Exploit the driver for privilege escalation" command: "Exploit.exe --driver 927e3aef03a8355d236230cace376b3023480a40c5ac08453c07dab343dd1f11"

927e3aef03a8355d236230cace376b3023480a40c5ac08453c07dab343dd1f11

According to Sophos X-Ops (Aug 06, 2025), a widely shared EDR-killer toolkit drops/loads a malicious kernel driver signed with compromised or revoked certificates to disable endpoint protections. Variants target many vendors, and are commonly HeartCrypt-packed and used by ransomware groups (e.g., RansomHub, INC). The payload uses hard-coded driver names (e.g., mraml.sys, noedt.sys) and kills security services/processes.

Use Case: Elevate privileges

Required Privileges: kernel

MITRE ATT&CK: T1068