{"Id":"29cb263b-b0b0-40d5-a97d-5ddf4ba79c1e","Tags":["goad.sys"],"Verified":"FALSE","Author":"Michael Haag","Created":"2023-01-09","MitreID":"T1068","Category":"vulnerable driver","Commands":{"Command":"sc.exe create goad.sys binPath=C:\\windows\\temp\\goad.sys type=kernel && sc.exe start goad.sys","Description":"","OperatingSystem":"Windows 10","Privileges":"kernel","Usecase":"Elevate privileges"},"Resources":["https://github.com/jbaines-r7/dellicious","https://www.rapid7.com/blog/post/2021/12/13/driver-based-attacks-past-and-present/"],"Detection":[],"Acknowledgement":{"Handle":"","Person":""},"KnownVulnerableSamples":[{"Company":"","Date":"","Description":"","FileVersion":"","Filename":"goad.sys","MD5":"312e31851e0fc2072dbf9a128557d6ef","MachineType":"","OriginalFilename":"","Product":"","ProductVersion":"","Publisher":"","Signature":[],"LoadsDespiteHVCI":"TRUE"}]}