examples:

• description: "Load the kernel driver" command: "sc.exe create DcProtect.sys binPath=C:\\windows\\temp\\DcProtect.sys type=kernel && sc.exe start DcProtect.sys"
• description: "Exploit the driver for privilege escalation" command: "Exploit.exe --driver DcProtect.sys"

DcProtect.sys

bundled with chinese application "DrvCeo" is a set of rootkits. The malicious functionality. prevents registry value writing where the registry key or value includes "dcprotect" or "drvceo". Prevents file deletion if pathname contains "driverdownload", "program files\sysceo", "program files (x86)\sysceo"

Use Case: Elevate privileges

Required Privileges: kernel

MITRE ATT&CK: T1068