{"Id":"4137ecf0-05e7-463a-94da-47b7259d4433","Tags":["81.sys"],"Verified":"FALSE","Author":"Michael Haag","Created":"2023-01-09","MitreID":"T1068","Category":"vulnerable driver","Commands":{"Command":"sc.exe create 81.sys binPath=C:\\windows\\temp\\81.sys type=kernel && sc.exe start 81.sys","Description":"","OperatingSystem":"Windows 10","Privileges":"kernel","Usecase":"Elevate privileges"},"Resources":["https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"],"Detection":[],"Acknowledgement":{"Handle":"","Person":""},"KnownVulnerableSamples":[{"Company":"","Date":"","Description":"","FileVersion":"","Filename":"81.sys","MachineType":"","OriginalFilename":"","Product":"","ProductVersion":"","Publisher":"","SHA1":"","Signature":[],"LoadsDespiteHVCI":"FALSE","Authentihash":{"MD5":"","SHA1":"faa870b0cb15c9ac2b9bba5d0470bd501ccd4326","SHA256":"b430d3a0bdb837a5d6625d3b1cef07abd1953f969869ff6cf7ba398ae605431a"}},{"Company":"","Date":"","Description":"","FileVersion":"","Filename":"81.sys","MachineType":"","OriginalFilename":"","Product":"","ProductVersion":"","Publisher":"","SHA1":"","Signature":[],"LoadsDespiteHVCI":"FALSE","Authentihash":{"MD5":"","SHA1":"aca8e53483b40a06dfdee81bb364b1622f9156fe","SHA256":"b430d3a0bdb837a5d6625d3b1cef07abd1953f969869ff6cf7ba398ae605431a"}},{"Company":"","Date":"","Description":"","FileVersion":"","Filename":"81.sys","MachineType":"","OriginalFilename":"","Product":"","ProductVersion":"","Publisher":"","SHA1":"","Signature":[],"LoadsDespiteHVCI":"FALSE","Authentihash":{"MD5":"","SHA1":"05ac1c64ca16ab0517fe85d4499d08199e63df26","SHA256":"b430d3a0bdb837a5d6625d3b1cef07abd1953f969869ff6cf7ba398ae605431a"}}]}