{"DetectionScope":"context-only","ResearchEvidence":{"Id":"204eccdf-99ca-4f2a-a325-8ebe34fd29a1","Tags":["bwrs.sys"],"Verified":"FALSE","Author":"Michael Haag","Created":"2023-01-09","MitreID":"T1068","Category":"vulnerable driver","Commands":{"Command":"sc.exe create bwrs.sys binPath=C:\\windows\\temp\\bwrs.sys type=kernel && sc.exe start bwrs.sys","Description":"","OperatingSystem":"Windows 10","Privileges":"kernel","Usecase":"Elevate privileges"},"Resources":["https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"],"Detection":[],"Acknowledgement":{"Handle":"","Person":""},"KnownVulnerableSamples":[{"Company":"","Date":"","Description":"","FileVersion":"","Filename":"bwrs.sys","MachineType":"","OriginalFilename":"","Product":"","ProductVersion":"","Publisher":"","Signature":[],"LoadsDespiteHVCI":"FALSE","Authentihash":{"SHA1":"3debe170b5a113407f9e86ee6ed9ae00c3d82c9f","SHA256":"221dfbc74bbb255b0879360ccc71a74b756b2e0f16e9386b38a9ce9d4e2e34f9"}}]}}