examples:

• description: "Load the kernel driver" command: "sc.exe create fd3b7234419fafc9bdd533f48896ed73_b816c5cd.sys binPath=C:\\windows\\temp\\fd3b7234419fafc9bdd533f48896ed73_b816c5cd.sys type=kernel && sc.exe start fd3b7234419fafc9bdd533f48896ed73_b816c5cd.sys"
• description: "Exploit the driver for privilege escalation" command: "Exploit.exe --driver fd3b7234419fafc9bdd533f48896ed73_b816c5cd.sys"

fd3b7234419fafc9bdd533f48896ed73_b816c5cd.sys

The criminals signed their AV-killer malware, closely related to one known as BURNTCIGAR, with a legitimate WHCP certificate

Use Case: Elevate privileges

Required Privileges: kernel

MITRE ATT&CK: T1068