examples:

• description: "Load the kernel driver" command: "sc.exe create HwRwDrv.sys binPath=C:\\windows\\temp\\HwRwDrv.sys type=kernel && sc.exe start HwRwDrv.sys"
• description: "Exploit the driver for privilege escalation" command: "Exploit.exe --driver HwRwDrv.sys"

HwRwDrv.sys

Hardware read/write driver signed by a revoked Certum certificate (Open Source Developer, Jun Liu). Provides arbitrary physical memory read/write and PCI bus data access. Identified in ESET EDR killers research (March 2026) with 174 execution parents indicating widespread abuse by threat actors to disable EDR products.

Use Case: Elevate privileges

Required Privileges: kernel

MITRE ATT&CK: T1068

Variants: 2 known variants