{"Id":"0e272ccf-81e5-4612-95d2-365e7ded6eac","Tags":["shield.sys","shield-async.sys","shieldwp.sys"],"Verified":"TRUE","Author":"Michael Haag","Created":"2026-06-16","MitreID":"T1068","Category":"vulnerable driver","Commands":{"Command":"sc.exe create shield binPath=C:\\windows\\temp\\shield.sys type=kernel && sc.exe start shield","Description":"Horizon DataSys Shield drivers expose IOCTL functionality reported to provide arbitrary kernel read/write primitives.","Usecase":"Load vulnerable signed disk filter drivers for kernel memory access","Privileges":"kernel","OperatingSystem":"Windows 10, Windows 11"},"Resources":["https://github.com/magicsword-io/LOLDrivers/issues/344"],"Detection":[],"Acknowledgement":{"Person":"","Handle":"DellaNotto"},"KnownVulnerableSamples":[{"Filename":"shield.sys","MD5":"97d6d9e9164354e40b5bcc828c6da3df","SHA1":"4d0f2a70ce5cd0c868454de9afe9b4b09fcef5df","SHA256":"b11db76aeab05f29e8f5d51cdfe70898a46fbd50a1245ca1aed39de10aafd401","Signature":["New Horizon Datasys Inc"],"Date":"07:33 PM 02/13/2026","Publisher":"New Horizon Datasys Inc","Company":"Horizon Datasys, Inc.","Description":"Shield disk filter driver","Product":"Reboot Restore Standard","ProductVersion":"v13.1","FileVersion":"v13.1","MachineType":"AMD64","OriginalFilename":"Shield.sys","InternalName":"Shield.sys","Copyright":"Copyright (C) Horizon Datasys, Inc. All rights reserved.","Imphash":"814ff5123980aa72132abc2d18aef873"},{"Filename":"shield-async.sys","MD5":"77e6a2b6883fb823d95d2d7659fedb1c","SHA1":"fde65f0c98d0ca07144febb877d658f0287d2c12","SHA256":"da3315363989b564a1b8b690bddfeb3bd81c1690a3da5813ca0c46a715fe94b0","Signature":["New Horizon Datasys Inc"],"Date":"07:33 PM 02/13/2026","Publisher":"New Horizon Datasys Inc","Company":"Horizon Datasys, Inc.","Description":"Shield async disk filter driver","Product":"Reboot Restore Standard","ProductVersion":"v13.1","FileVersion":"v13.1","MachineType":"AMD64","OriginalFilename":"Shield-async.sys","InternalName":"Shield-async.sys","Copyright":"Copyright (C) Horizon Datasys, Inc. All rights reserved.","Imphash":"ac0b82ea403e2908815d3497b8178fe8"},{"Filename":"shieldwp.sys","MD5":"e2bfb13653b0569e4c3ddbde10f89493","SHA1":"46ac52bc089575a393e6fc9adec6b63f63190e1c","SHA256":"b1547490f3040b1e3668ee195adbf2d312024809915d01a71ed75fae72971a9d","Signature":["New Horizon Datasys Inc"],"Date":"07:34 PM 02/13/2026","Publisher":"New Horizon Datasys Inc","Company":"Horizon Datasys, Inc.","Description":"Shield disk filter driver","Product":"Reboot Restore Standard","ProductVersion":"v13.1","FileVersion":"v13.1","MachineType":"AMD64","OriginalFilename":"Shield.sys","InternalName":"Shield.sys","Copyright":"Copyright (C) Horizon Datasys, Inc. All rights reserved.","Imphash":"5a177e1c90aa9a1b811debb084c64f92"}]}