SentinelOne has observed prominent threat actors abusing legitimately signed Microsoft drivers in active intrusions into telecommunication, BPO, MSSP, and financial services businesses. Investigations into these intrusions led to the discovery of POORTRY and STONESTOP malware, part of a small toolkit designed to terminate AV and EDR processes. We first reported our discovery to Microsoft’s Security Response Center (MSRC) in October 2022 and received an official case number (75361). Today, MSR...
sc.exe create LcTkA.sys binPath=C:\windows\temp\LcTkA.sys type=kernel && sc.exe start LcTkA.syssc.exe create LcTkA.sys binPath=C:\windows\temp\LcTkA.sys type=kernel && sc.exe start LcTkA.sysSandbox: execFile · Timeout: 30s
security.privilegeescalation.kernel-exploit examples:
SentinelOne has observed prominent threat actors abusing legitimately signed Microsoft drivers in active intrusions into telecommunication, BPO, MSSP, and financial services businesses. Investigations into these intrusions led to the discovery of POORTRY and STONESTOP malware, part of a small toolkit designed to terminate AV and EDR processes. We first reported our discovery to Microsoft’s Security Response Center (MSRC) in October 2022 and received an official case number (75361). Today, MSRC released an associated advisory under ADV220005. This research is being released alongside Mandiant, a SentinelOne technology and incident response partner.
Use Case: Elevate privileges
Required Privileges: kernel
MITRE ATT&CK: T1068