examples:

• description: "Load the kernel driver" command: "sc.exe create vsdatant binPath=C:\\Windows\\Temp\\vsdatant.sys type=kernel && sc.exe start vsdatant"
• description: "Exploit the driver for privilege escalation" command: "Exploit.exe --driver vsdatant.sys"

vsdatant.sys

Check Point ZoneAlarm driver (vsdatant.sys) abused in BYOVD attacks to gain kernel privileges and bypass protections such as Memory Integrity.

Use Case: BYOVD (kernel) privilege escalation / defense evasion

Required Privileges: kernel

MITRE ATT&CK: T1068