Teramind Inc. kernel-mode filter drivers (tm_filter.sys and tmfsdrv2.sys) providing kernel-level input capture including keylogging and screen capture capabilities. Both signed by DigiCert under Teramind Inc. certificate. Execution parents point to teramind_agent MSI installer. Abused by threat actors for stealth monitoring operations. tmfsdrv2.sys has 1/73 detections on VirusTotal.
sc.exe create tmfsdrv2 binPath=C:\windows\temp\tmfsdrv2.sys type=kernel && sc.exe start tmfsdrv2sc.exe create tmfsdrv2 binPath=C:\windows\temp\tmfsdrv2.sys type=kernel && sc.exe start tmfsdrv2Sandbox: execFile · Timeout: 30s
security.privilegeescalation.kernel-exploit examples:
Teramind Inc. kernel-mode filter drivers (tm_filter.sys and tmfsdrv2.sys) providing kernel-level input capture including keylogging and screen capture capabilities. Both signed by DigiCert under Teramind Inc. certificate. Execution parents point to teramind_agent MSI installer. Abused by threat actors for stealth monitoring operations. tmfsdrv2.sys has 1/73 detections on VirusTotal.
Use Case: Capture user input and screen content for surveillance
Required Privileges: kernel
MITRE ATT&CK: T1056.001