windows verified high v1.0.0

throttlestop.sys

ThrottleStop is developed by TechPowerUp and is designed to monitor for and correct CPU throttling issues. However, Kaspersky researchers from the Global Emergency Response Team (GERT) found out that it is being abused by attackers to terminate defense mechanisms.

📋 Live Preview 
sc.exe create throttlestop.sys binPath= C:\windows\temp\throttlestop.sys type=kernel && sc.exe start throttlestop.sys
sc.exe create throttlestop.sys binPath= C:\windows\temp\throttlestop.sys type=kernel && sc.exe start throttlestop.sys

Sandbox: execFile · Timeout: 30s

Capabilities

security.privilegeescalation.kernel-exploit

Detection

TypeRule / Indicator
yara https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar
sigma https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml
sigma https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml
sysmon https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml
sysmon https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml

Documentation

examples:

  • description: "Load the kernel driver" command: "sc.exe create throttlestop.sys binPath= C:\\windows\\temp\\throttlestop.sys type=kernel && sc.exe start throttlestop.sys"
  • description: "Exploit the driver for privilege escalation" command: "Exploit.exe --driver throttlestop.sys"

throttlestop.sys

ThrottleStop is developed by TechPowerUp and is designed to monitor for and correct CPU throttling issues. However, Kaspersky researchers from the Global Emergency Response Team (GERT) found out that it is being abused by attackers to terminate defense mechanisms.

Use Case: Elevate privileges

Required Privileges: kernel

MITRE ATT&CK: T1068

References