{"Id":"0712c54c-69fd-41f2-950a-da678ac51246","Tags":["STProcessMonitor.sys","ProcessMonitorDriver.sys","STProcessMonitor_v114.sys"],"Verified":"TRUE","Author":"Michael Haag","Created":"2026-03-20","MitreID":"T1562.001","Category":"vulnerable driver","Commands":{"Command":"sc.exe create STProcessMonitor binPath=C:\\windows\\temp\\STProcessMonitor.sys type=kernel && sc.exe start STProcessMonitor","Description":"Safetica STProcessMonitor / ProcessMonitorDriver.sys exposes process-termination functionality through vulnerable IOCTL paths documented in public BYOVD research. The tracked samples include the 11.26.18.0 build and the legacy 11.11.4.0 build; public research notes that affected versions can be abused to terminate endpoint security processes from kernel context.","Usecase":"Disable security tools","Privileges":"kernel","OperatingSystem":"Windows 10"},"Resources":["https://www.cve.org/CVERecord?id=CVE-2025-70795","https://github.com/magicsword-io/LOLDrivers/issues/268","https://github.com/KOSEC-LLC/BYOVD-Research/tree/main/Safetica","https://github.com/BlackSnufkin/BYOVD/tree/main/STProcessMonitor-Killer"],"Detection":[],"Acknowledgement":{"Person":"","Handle":""},"KnownVulnerableSamples":[{"Filename":"STProcessMonitor.sys","MD5":"5761bd63da03686fc480245da7bd1e9f","SHA1":"68fec379f2ae76c3d2ce913f7be650cea1d06990","SHA256":"5b4f59236a9b950bcd5191b35d19125f60cfb9e1a1e1aa2e4f914b6745dde9df","Signature":["Microsoft Windows Hardware Compatibility Publisher","Microsoft Windows Third Party Component CA 2012","Microsoft Root Certificate Authority 2010"],"Date":"2026-02-04 12:24:39","Publisher":"Microsoft Windows Hardware Compatibility Publisher","Company":"Safetica Technologies","Description":"ProcessMonitor Driver","Product":"Safetica","ProductVersion":"11.26.18","FileVersion":"11,26,18,0","MachineType":"AMD64","OriginalFilename":"ProcessMonitorDriver","Authentihash":{"MD5":"7590bc612d1cb940d6acf2d7ae384638","SHA1":"01bf6090818731e8121674a339a5f22cb18cf41d","SHA256":"0376d4554b4828a7e3721327cb4c9977301c02eb8c50d10d376d3be623d71e3a"},"RichPEHeaderHash":{"MD5":"6eb21f070cb73b6994e6b9aab3f72279","SHA1":"ebe9c1483d5dc68041bbbf053dfd08c4651931e8","SHA256":"a0b5c0bad77a66d6a25df16f7a2500b6df550eda8ba62333b5d1eccfeee7bf27"},"InternalName":"STProcessMonitor","Copyright":"Copyright (C) 2026, Safetica","Imports":["FLTMGR.SYS","ntoskrnl.exe"],"ImportedFunctions":["FltDeletePushLock","FltAcquirePushLockExclusiveEx","FltAcquirePushLockSharedEx","FltReleasePushLockEx","FltInitializePushLock","DbgPrintEx","KeGetCurrentIrql","ExFreePoolWithTag","ObfReferenceObject","ObfDereferenceObject","PsGetCurrentProcessId","PsGetCurrentThreadId","RtlInitUnicodeString","RtlCreateSecurityDescriptor","RtlSetDaclSecurityDescriptor","RtlGetVersion","KeSetEvent","KeEnterCriticalRegion","KeLeaveCriticalRegion","ExAllocatePoolWithTag","IofCompleteRequest","IoCreateDevice","IoCreateSymbolicLink","IoDeleteDevice","IoDeleteSymbolicLink","ObReferenceObjectByHandle","ZwClose","PsSetCreateProcessNotifyRoutineEx","ZwTerminateProcess","ZwOpenProcess","RtlCreateAcl","RtlAddAccessAllowedAce","ObOpenObjectByPointer","ZwSetSecurityObject","ExEventObjectType","SeExports","ZwSetInformationFile","KeLowerIrql","KfRaiseIrql","KeInitializeDpc","KeInsertQueueDpc","KeReleaseSemaphore","KeDelayExecutionThread","KeAcquireSpinLockRaiseToDpc","KeReleaseSpinLock","ExQueueWorkItem","ExReleaseResourceLite","ZwCreateFile","ZwWriteFile","ExAcquireResourceSharedLite","ZwOpenFile","_vsnwprintf"],"ExportedFunctions":["_debugBootBuffer"],"Sections":{".text":{"Entropy":6.428505923098718,"Virtual Size":"0x4746"},".rdata":{"Entropy":3.58177960578637,"Virtual Size":"0xa10"},".data":{"Entropy":0.7160577749375858,"Virtual Size":"0x5b8"},".pdata":{"Entropy":3.9739405644983465,"Virtual Size":"0x1ec"},".edata":{"Entropy":3.884391278160638,"Virtual Size":"0x5c"},"INIT":{"Entropy":5.123228842197757,"Virtual Size":"0x6c4"},".rsrc":{"Entropy":3.213987592792559,"Virtual Size":"0x3d0"},".reloc":{"Entropy":3.762314746027603,"Virtual Size":"0x38"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2026-02-04 12:24:39","Imphash":"51777abf89572dc6d0ba931ade6ae5b9","Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher","ValidFrom":"2025-11-13 19:59:40","ValidTo":"2026-11-10 19:59:40","Signature":"86e91c9dd77bcbe24e9c811c4ec9c47116d9d554243f04666bef14828edbfeb665280fa10b643a59d05c4db8b5f2bae0657af9a75457236e455f956ed7ba65f7e8019355d00e322f681ab15f14718b34bff1e50d8cde1217dc158c31a875b17fa45f015b4b2a30c471d43345257c729d83c2287716b3d19c177ed341da95687f8af92cfebc42e1e4439eb4304762e17feb85a09316afe8153e4783a98153d91249d29da0bca831ea6ccd93bace88fc284e82987df65bcd8ab0263a2da5e178e710c26e8abec12fe398782d1f1bc669ec9c5cbf3010f8e2600133a59fb8269daba61e5b2facee4f96ba19f9cfaef3fdb21e933a65c3245f6de70cb08f28f2c818","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"330000013c4a61fb3578d2b6dd00000000013c","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"93354b540685ae615b51e692ea0895de","SHA1":"b38cd5d491c85bd55e9b111e98430171a01e9515","SHA256":"037c041a283132dc57d29bc339b4d0d006787e32ac0a60afd7206c41c9fbf61f","SHA384":"bbef5ad51ba2a76ba3f0e39459837c9533a56420db0da55814511346155922c98ae905d6541df5a79895ce1a51d53491"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2012","ValidFrom":"2012-04-18 23:48:38","ValidTo":"2027-04-18 23:58:38","Signature":"5a8a67daccd5fd0d264177bf0a4678b4b3de12692b7723c2652f015fd203f461ba509d2e8c3972f36c3e6ab11e766decb7f382dcccbbc56970287366173f54ebee011648c446d91b80ae813a8d0f796d68b09eea2d3f39d3ca387ebd5e7c086e19dcc6c2f438336861e2524783e1000156d2bacb878205310a418b4ee77f5f5fed5fd3392d45eba213bffd1ec298417161165fc80a70257c59693124e471e70abb0417f79f721ec9d2bb1abe3d02fe090cb243b4591a99539396215fe0d6b72601429536ac27fdbef48577683d18bdf4be98882211865216f345ec0397107087a37043713cdbc98603170cf5735bc67de15c64edd7c548d7ed32e2d1aad3cfa7f6574e61f977eb67f288b3de00da038fd08a34373e1dd862b8d2b1f3e12f8b723b81967c6ffcec667672601b24f2a0896d5b6d002eef28dd868705c2b4b9e5be64c22af24a155c98e2c42785ff52e3627e0fb2020bd766c70ab2d33d200414503259830a7d9bed5a38120152ba2f5e20728e4af1fde771028c3be107bec973f4dd47d8b4efb4a4b330b9893e76cab90098567eabea8ab8a5d038ab6977130b142fe9aa411ff7babd3a2b348aee0aab63e663f788248e200d2b3b9de3c24952ac9f1f0e393b5dd46e506ae67d523aaa7c3315290d265e0158a74ea93d7a846f743f609fe4324f3600af6d71d33ea646655f8174f1fec171da4ca0415a82ddf11f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"610baac1000000000009","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"a569061297e8e824767dbc3184a69bea","SHA1":"adbb26a587a8f44b4fccaecb306f980d1c55a150","SHA256":"cec1afd0e310c55c1dcc601ab8e172917706aa32fb5eaf826813547fdf02dd46","SHA384":"e947cac936803f5683196e4ff1b259096073395d0b908522ddce90d57597c9f7b57f7ddcdbe021ba863d843c340da8ba"}}],"Signer":[{"SerialNumber":"330000013c4a61fb3578d2b6dd00000000013c","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2012","Version":1}]}]},{"Filename":"ProcessMonitorDriver.sys","SHA256":"70bcec00c215fe52779700f74e9bd669ff836f594df92381cbfb7ee0568e7a8b","MD5":"485a04675df7cf40a8865706e003eb25","SHA1":"711ef221526997039e804a18db9647c91680bbe2","Imphash":"ce19d9c0ab826dbae6f1376e7c9ef40f","Authentihash":{"MD5":"30cdcd7b597209ca662a0cacce2e7b28","SHA1":"e66c967dc212c7e96b771016e2fff82a2e281824","SHA256":"ea80d2e65b03ea918f918d60cc8397aa4ee11eeb7bf679c7813311ff32ed5c81"},"RichPEHeaderHash":{"MD5":"54853ebfe20dbb8140b5133582cae441","SHA1":"2b52dd0029cbea40438170c2710726a9efb40705","SHA256":"a247b74d4248c0ac396695592b2719dde58eedecc7d1e93d8ab40b55032049ef"},"Sections":{".text":{"Entropy":6.440642827225935,"Virtual Size":"0x43c6"},".rdata":{"Entropy":3.969696678076276,"Virtual Size":"0x890"},".data":{"Entropy":0.7231078539892202,"Virtual Size":"0x588"},".pdata":{"Entropy":3.994908330034113,"Virtual Size":"0x1e0"},".edata":{"Entropy":3.884391278160638,"Virtual Size":"0x5c"},"INIT":{"Entropy":5.117452153830264,"Virtual Size":"0x5ea"},".rsrc":{"Entropy":3.209365075660328,"Virtual Size":"0x3c8"},".reloc":{"Entropy":3.7873653599368224,"Virtual Size":"0x38"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2025-05-07 06:52:30","Description":"ProcessMonitor Driver","Company":"Safetica Technologies","InternalName":"STProcessMonitor","OriginalFilename":"ProcessMonitorDriver","FileVersion":"11,11,4,0","Product":"Safetica","ProductVersion":"11.11.4","Copyright":"Copyright (C) 2025, Safetica","MachineType":"AMD64","Imports":["FLTMGR.SYS","ntoskrnl.exe"],"ExportedFunctions":["_debugBootBuffer"],"ImportedFunctions":["FltDeletePushLock","FltAcquirePushLockExclusiveEx","FltAcquirePushLockSharedEx","FltReleasePushLockEx","FltInitializePushLock","DbgPrintEx","KeGetCurrentIrql","ExFreePoolWithTag","ObfReferenceObject","ObfDereferenceObject","PsGetCurrentProcessId","PsGetCurrentThreadId","RtlInitUnicodeString","RtlGetVersion","KeSetEvent","KeEnterCriticalRegion","KeLeaveCriticalRegion","ExAllocatePoolWithTag","IofCompleteRequest","IoCreateDevice","IoCreateSymbolicLink","IoDeleteDevice","IoDeleteSymbolicLink","ObReferenceObjectByHandle","ZwClose","PsSetCreateProcessNotifyRoutineEx","ZwTerminateProcess","ZwOpenProcess","ExEventObjectType","ZwSetInformationFile","KeLowerIrql","KfRaiseIrql","KeInitializeDpc","KeInsertQueueDpc","KeReleaseSemaphore","KeDelayExecutionThread","KeAcquireSpinLockRaiseToDpc","KeReleaseSpinLock","ExQueueWorkItem","ExReleaseResourceLite","ZwCreateFile","ZwWriteFile","ExAcquireResourceSharedLite","ZwOpenFile","_vsnwprintf"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher","ValidFrom":"2025-02-20 20:08:09","ValidTo":"2026-02-18 20:08:09","Signature":"65d17fbf1de2b60cfc46b9d9945a9c84c28a9bac84abe3f49280bca6ff239461c1ba338bfc578d94c884e783881036e134bfd12b52e916281b220f6d34b8ca017fd2880da3b76f90303f497eb18ceebd711083097fee149c5ed15e3b7b4d20ecccb93798c03c462f0039f11b260167512ffd103e20b7b306603f07c1f68940a7074b648a650271c2cbf1dda3e5ba29028c027373faaf255d2af35a86fe539dc5ab7134a4994d5994b4ba7f189bd428778554f9e6402ba8c2cc832bc9fc64d5f6058c2fb6c28ce11798762addd0d567d724e7727b9c3253ea7be34f357ff32c8bb91e8eb198d858118254ceed218f47e94482e8a15f7e095f98c36986f7fa06eb","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"3300000125f31cb555767340d6000000000125","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"581df130bb04487a6d19bc11b5098119","SHA1":"900451bd61a1199f8b4994f451af8201a1f40c7b","SHA256":"82efe580f6ea4f2a1f39e1f0eaf14983218c1eccbb5d7c80b421501bd4a05a90","SHA384":"0debca99ab93db249e18bef9f007861026c31369eacd2eed479765dc192da38c37eb02848f744df8e94ec9afe19fa0de"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2012","ValidFrom":"2012-04-18 23:48:38","ValidTo":"2027-04-18 23:58:38","Signature":"5a8a67daccd5fd0d264177bf0a4678b4b3de12692b7723c2652f015fd203f461ba509d2e8c3972f36c3e6ab11e766decb7f382dcccbbc56970287366173f54ebee011648c446d91b80ae813a8d0f796d68b09eea2d3f39d3ca387ebd5e7c086e19dcc6c2f438336861e2524783e1000156d2bacb878205310a418b4ee77f5f5fed5fd3392d45eba213bffd1ec298417161165fc80a70257c59693124e471e70abb0417f79f721ec9d2bb1abe3d02fe090cb243b4591a99539396215fe0d6b72601429536ac27fdbef48577683d18bdf4be98882211865216f345ec0397107087a37043713cdbc98603170cf5735bc67de15c64edd7c548d7ed32e2d1aad3cfa7f6574e61f977eb67f288b3de00da038fd08a34373e1dd862b8d2b1f3e12f8b723b81967c6ffcec667672601b24f2a0896d5b6d002eef28dd868705c2b4b9e5be64c22af24a155c98e2c42785ff52e3627e0fb2020bd766c70ab2d33d200414503259830a7d9bed5a38120152ba2f5e20728e4af1fde771028c3be107bec973f4dd47d8b4efb4a4b330b9893e76cab90098567eabea8ab8a5d038ab6977130b142fe9aa411ff7babd3a2b348aee0aab63e663f788248e200d2b3b9de3c24952ac9f1f0e393b5dd46e506ae67d523aaa7c3315290d265e0158a74ea93d7a846f743f609fe4324f3600af6d71d33ea646655f8174f1fec171da4ca0415a82ddf11f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"610baac1000000000009","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"a569061297e8e824767dbc3184a69bea","SHA1":"adbb26a587a8f44b4fccaecb306f980d1c55a150","SHA256":"cec1afd0e310c55c1dcc601ab8e172917706aa32fb5eaf826813547fdf02dd46","SHA384":"e947cac936803f5683196e4ff1b259096073395d0b908522ddce90d57597c9f7b57f7ddcdbe021ba863d843c340da8ba"}}],"Signer":[{"SerialNumber":"3300000125f31cb555767340d6000000000125","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2012","Version":1}]}]}]}