{"Id":"080ff223-f8e0-49c0-a7b5-e97349cf81a0","Tags":["HpPortIox64.sys"],"Verified":"TRUE","Author":"Michael Haag","Created":"2023-01-09","MitreID":"T1068","Category":"vulnerable driver","Commands":{"Command":"sc.exe create HpPortIox64.sys binPath=C:\\windows\\temp\\HpPortIox64.sys     type=kernel && sc.exe start HpPortIox64.sys","Description":"","OperatingSystem":"Windows 10","Privileges":"kernel","Usecase":"Elevate privileges"},"Resources":["https://github.com/elastic/protections-artifacts/search?q=VulnDriver"],"Detection":[{"type":"yara_signature","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/c5050a2017490fff7aa53c73755982b339ddb0fd7cef2cde32c81bc9834331c5.yara"},{"type":"sigma_hash","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"},{"type":"sigma_names","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"},{"type":"sysmon_hash_detect","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"},{"type":"sysmon_hash_block","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"},{"type":"yara_signature","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"},{"type":"sigma_hash","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"},{"type":"sigma_names","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"},{"type":"sysmon_hash_detect","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"},{"type":"sysmon_hash_block","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"}],"Acknowledgement":{"Handle":"","Person":""},"KnownVulnerableSamples":[{"Authentihash":{"MD5":"986877a0cf596be97155e9469f3c4b40","SHA1":"98807d9e11bad4feed54d0d2c1abadeb95ca997c","SHA256":"35b31c96194d78cbb98b3223bf810f78f53fc0e4601f49169938ca883586e4e9"},"Company":"HP Inc.","Copyright":"Copyright (C) 2020-2021 HP Inc. All rights reserved.","CreationTimestamp":"2021-04-20 23:22:47","Date":"","Description":"HpPortIo","ExportedFunctions":"","FileVersion":"1.2.0.9","Filename":"HpPortIox64.sys","ImportedFunctions":["MmGetSystemRoutineAddress","RtlUnicodeStringToAnsiString","ExAllocatePool","ZwClose","RtlAppendUnicodeStringToString","ObReferenceObjectByHandle","RtlCopyUnicodeString","MmIsAddressValid","ExFreePoolWithTag","ZwOpenFile","DbgPrint","RtlEqualUnicodeString","ZwCreateFile","KeBugCheckEx","RtlVolumeDeviceToDosName","ExAllocatePoolWithTag","DbgPrintEx","IoCreateDevice","IoCreateSymbolicLink","RtlFreeAnsiString","IofCompleteRequest","RtlFreeUnicodeString","RtlInitString","IoDeleteDevice","RtlInitUnicodeString","strstr","RtlAnsiStringToUnicodeString","ObfDereferenceObject","IoDeleteSymbolicLink","ZwReadFile","RtlUTF8ToUnicodeN","RtlTimeFieldsToTime","RtlCharToInteger","RtlCompareMemory","RtlAssert","__C_specific_handler","HalSetBusDataByOffset","HalGetBusDataByOffset"],"Imports":["ntoskrnl.exe","HAL.dll"],"InternalName":"HpPortIox64.sys","MD5":"a641e3dccba765a10718c9cb0da7879e","MachineType":"AMD64","MagicHeader":"50 45 0 0","OriginalFilename":"HpPortIox64.sys","Product":"HpPortIo","ProductVersion":"1.2.0.9","Publisher":"","RichPEHeaderHash":{"MD5":"4d4d28dcc041614dbd266ba38ab0b695","SHA1":"4d93ccf1496f49e241e0a8948d5f356787864952","SHA256":"2dba8cdd15e9042ac6f8f474ed1bd3c6ed65b64176bee0edb8a763ec144183c5"},"SHA1":"8c377ab4eebc5f4d8dd7bb3f90c0187dfdd3349f","SHA256":"c5050a2017490fff7aa53c73755982b339ddb0fd7cef2cde32c81bc9834331c5","Sections":{".text":{"Entropy":5.606025812365913,"Virtual Size":"0x5d61"},".rdata":{"Entropy":4.972101999668686,"Virtual Size":"0xf84"},".data":{"Entropy":1.2741239614517732,"Virtual Size":"0x1b8"},".pdata":{"Entropy":4.080437825589189,"Virtual Size":"0x270"},"INIT":{"Entropy":5.127227635761384,"Virtual Size":"0x534"},".rsrc":{"Entropy":3.2845087920390967,"Virtual Size":"0x3a8"},".reloc":{"Entropy":1.584962500721156,"Virtual Size":"0xc"}},"Signature":["HP Inc.","DigiCert SHA2 Assured ID Code Signing CA","DigiCert"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 Assured ID Code Signing CA","ValidFrom":"2013-10-22 12:00:00","ValidTo":"2028-10-22 12:00:00","Signature":"3eec0d5a24b3f322d115c82c7c252976a81d5d1c2d3a1ac4ef3061d77e0b60fdc33d0fc4af8bfdef2adf205537b0e1f6d192750f51b46ea58e5ae25e24814e10a4ee3f718e630e134badd75f4479f33614068af79c464e5cff90b11b070e9115fbbaafb551c28d24ae24c6c7272aa129281a3a7128023c2e91a3c02511e29c1447a17a6868af9ba75c205cd971b10c8fbba8f8c512689fcf40cb4044a513f0e6640c25084232b2368a2402fe2f727e1cd7494596e8591de9fa74646bb2eb6643dab3b08cd5e90dddf60120ce9931633d081a18b3819b4fc6931006fc0781fa8bdaf98249f7626ea153fa129418852e9291ea686c4432b266a1e718a49a6451ef","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"0409181b5fd5bb66755343b56f955008","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"9359496ca4f021408b9d8923cab8b179","SHA1":"2aed40d7759997830870769be250199fd609e40e","SHA256":"e767799478f64a34b3f53ff3bb9057fe1768f4ab178041b0dcc0ff1e210cba65","SHA384":"5cb7e7b4f1dbccd48d10db7e71b6f8c05fcb4bcb0085a6fefcfa0c2148f9a594e59f56ac4304004f3b398e259035c40c"}},{"Subject":"C=US, ST=California, L=Palo Alto, O=HP Inc., OU=HP Cybersecurity, CN=HP Inc.","ValidFrom":"2020-05-14 00:00:00","ValidTo":"2021-05-19 12:00:00","Signature":"f2d1a458df5efa9cd81a8ee531f040d22d4a0ddd4c3ee66272cd114b9f0f399243a7d3c810ada729d8677d7adebfb7f3d8c98160d8ef936a372cf095f8f3407153e4dc4dfe899b9cacd1c3169869da98a3a90a8933c2f04acf67572f25259adb3670b4cfb30c1916f690f4f771bb68bcbcfb6e8a9a8bf4c0948f2397fd570a4281b25978e1da0c01e4460f9d8f4c7df28724d196a256aba21081a3de98aae12cf34ea26eefd79adf1866d2898011da1b626dcb18e384b30edc7ff8703f7bec19b197da6494c435b98a5fad01b9885c3d43726d1d69c55283f950d8e9b267dd4cbd0c8d8879bbb1347025571710a63fed825e67ed93dc0ef58fb8d0ed87f1bd14","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"0449edef08b987f05203c4e0f2356499","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"5e993a919f907013f89ff0215fcfdf29","SHA1":"b8b101040d1a81a545ae65cc953979880d3c1b10","SHA256":"8896a2b0f531a6672e0b827766d86766184f0e350785a3c263fc67347e99fe75","SHA384":"8ca6718d1dfe26aabc763217c248619ba30a5485604d1e197ea049a93dc487fba8332c07437ce13bfe67e8075fcf3745"}}],"Signer":[{"SerialNumber":"0449edef08b987f05203c4e0f2356499","Issuer":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 Assured ID Code Signing CA","Version":1}]}],"Imphash":"75018719e85e67b75e73c57d682dbcbf","LoadsDespiteHVCI":"FALSE"}]}