Safetica Technologies process monitoring kernel driver vulnerable to BYOVD-style process termination via IOCTL. CVE-2025-70795. 18 execution parents observed in VirusTotal indicating active abuse by threat actors. 1/73 detections. Driver facilitates arbitrary process kill from kernel context, enabling EDR/AV bypass.
sc.exe create STProcessMonitor binPath=C:\windows\temp\STProcessMonitor.sys type=kernel && sc.exe start STProcessMonitorsc.exe create STProcessMonitor binPath=C:\windows\temp\STProcessMonitor.sys type=kernel && sc.exe start STProcessMonitorSandbox: execFile · Timeout: 30s
security.privilegeescalation.kernel-exploit examples:
Safetica Technologies process monitoring kernel driver vulnerable to BYOVD-style process termination via IOCTL. CVE-2025-70795. 18 execution parents observed in VirusTotal indicating active abuse by threat actors. 1/73 detections. Driver facilitates arbitrary process kill from kernel context, enabling EDR/AV bypass.
Use Case: Disable security tools
Required Privileges: kernel
MITRE ATT&CK: T1562.001