Capabilities

security.privilegeescalation.kernel-exploit

Detection

Type	Rule / Indicator
yara	https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_mal_drivers_strict.yar
sigma	https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml
sigma	https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml
sysmon	https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml
sysmon	https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml

Documentation

examples:

description: "Load the kernel driver" command: "sc.exe create WinTapix.sys binPath=C:\\windows\\temp\\WinTapix.sys type=kernel && sc.exe start WinTapix.sys"
description: "Exploit the driver for privilege escalation" command: "Exploit.exe --driver WinTapix.sys"

WinTapix.sys

Wintapix.sys is partially protected by VMProtect, a software protection tool that uses virtualization to protect software applications from reverse engineering and unauthorized usage. It transforms the original executable file into a virtualized code executed in a protected environment, making it difficult to analyze and tamper with.

Use Case: Elevate privileges

Required Privileges: kernel

MITRE ATT&CK: T1068

References

Reference