{"Id":"058fb356-e0ff-4f5e-8293-319feb005db2","Tags":["bandai.sys"],"Verified":"FALSE","Author":"Michael Haag","Created":"2023-01-09","MitreID":"T1068","Category":"vulnerable driver","Commands":{"Command":"sc.exe create bandai.sys binPath=C:\\windows\\temp\\bandai.sys type=kernel && sc.exe start bandai.sys","Description":"","OperatingSystem":"Windows 10","Privileges":"kernel","Usecase":"Elevate privileges"},"Resources":["https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"],"Detection":[],"Acknowledgement":{"Handle":"","Person":""},"KnownVulnerableSamples":[{"Company":"","Date":"","Description":"","FileVersion":"","Filename":"bandai.sys","MachineType":"","OriginalFilename":"","Product":"","ProductVersion":"","Publisher":"","SHA1":"","Signature":[],"LoadsDespiteHVCI":"FALSE","Authentihash":{"MD5":"","SHA1":"0f780b7ada5dd8464d9f2cc537d973f5ac804e9c","SHA256":"7fd788358585e0b863328475898bb4400ed8d478466d1b7f5cc0252671456cc8"}},{"Company":"","Date":"","Description":"","FileVersion":"","Filename":"bandai.sys","MachineType":"","OriginalFilename":"","Product":"","ProductVersion":"","Publisher":"","SHA1":"","Signature":[],"LoadsDespiteHVCI":"FALSE","Authentihash":{"MD5":"","SHA1":"0f780b7ada5dd8464d9f2cc537d973f5ac804e9c","SHA256":"7fd788358585e0b863328475898bb4400ed8d478466d1b7f5cc0252671456cc8"}}]}