{"Id":"0f6c3a28-4d04-474b-a098-37383f984686","Tags":["WinIO32.sys"],"Verified":"FALSE","Author":"Michael Haag","Created":"2023-01-09","MitreID":"T1068","Category":"vulnerable driver","Commands":{"Command":"sc.exe create WinIO32.sys binPath=C:\\windows\\temp\\WinIO32.sys type=kernel && sc.exe start WinIO32.sys","Description":"","OperatingSystem":"Windows 10","Privileges":"kernel","Usecase":"Elevate privileges"},"Resources":["https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"],"Detection":[],"Acknowledgement":{"Handle":"","Person":""},"KnownVulnerableSamples":[{"Company":"","Date":"","Description":"","FileVersion":"","Filename":"WinIO32.sys","MD5":"","MachineType":"","OriginalFilename":"","Product":"","ProductVersion":"","Publisher":"","SHA1":"","SHA256":"","Signature":[],"LoadsDespiteHVCI":"FALSE","Authentihash":{"MD5":"","SHA1":"8fb149fc476cf5bf18dc575334edad7caf210996","SHA256":"40a8fd2d1de93611ac88f29352476fbe0c2607b1d973dab8923ff0811f92f659"}}]}