{"Id":"70acea34-7ed2-42d5-885c-eca3c2de640c","Tags":["Sense5Ext.sys"],"Verified":"TRUE","Author":"Michael Haag, Guus Verbeek","Created":"2023-03-04","MitreID":"T1068","Category":"malicious","Commands":{"Command":"sc.exe create Sense5Ext.sys binPath=C:\\windows\\temp\\Sense5Ext.sys type=kernel && sc.exe start Sense5Ext.sys","Description":"Driver categorized as POORTRY by Mandiant.","OperatingSystem":"Windows 10","Privileges":"kernel","Usecase":"Elevate privileges"},"Resources":["https://www.mandiant.com/resources/blog/hunting-attestation-signed-malware"],"Detection":[{"type":"yara_signature","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/7f4555a940ce1156c9bcea9a2a0b801f9a5e44ec9400b61b14a7b1a6404ffdf6.yara"},{"type":"yara_signature","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/42b22faa489b5de936db33f12184f6233198bdf851a18264d31210207827ba25.yara"},{"type":"sigma_hash","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"},{"type":"sigma_names","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"},{"type":"sysmon_hash_detect","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"},{"type":"sysmon_hash_block","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"},{"type":"yara_signature","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_mal_drivers_strict.yar"},{"type":"sigma_hash","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"},{"type":"sigma_names","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"},{"type":"sysmon_hash_detect","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"},{"type":"sysmon_hash_block","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"}],"Acknowledgement":{"Handle":"","Person":""},"KnownVulnerableSamples":[{"Authentihash":{"MD5":"0b2ce413f69677a0bf78a40ed0d081a7","SHA1":"af83d2f800c68099976dcf75ee31681708d32ed9","SHA256":"13cd99ff2120d9fd651814d826b6c8481d549f684a8fbfb2d8775c9faa1c27f5"},"Company":"Sense5 CORP","Copyright":"Copyright (C) 2022","CreationTimestamp":"2022-08-22 09:52:21","Date":"","Description":"Sense5 Driver","ExportedFunctions":"","FileVersion":"2.6.0.0","Filename":"Sense5Ext.sys","ImportedFunctions":["IoGetCurrentProcess","ObReferenceObjectByHandle","ObfDereferenceObject","PsGetCurrentProcessId","NtBuildNumber","RtlTimeToTimeFields","ExSystemTimeToLocalTime","ZwCreateFile","ZwWriteFile","ZwClose","_snprintf","_vsnprintf","ZwQueryInformationFile","ZwReadFile","strcmp","strncmp","RtlCompareMemory","RtlImageNtHeader","RtlCompareUnicodeString","ExAllocatePoolWithTag","ExFreePoolWithTag","isupper","isdigit","tolower","strlen","_stricmp","strstr","wcscat","wcslen","RtlInitAnsiString","RtlQueryRegistryValues","RtlAnsiStringToUnicodeString","RtlCompareUnicodeStrings","ExAllocatePool","MmGetSystemRoutineAddress","PsCreateSystemThread","PsTerminateSystemThread","PsSetCreateProcessNotifyRoutineEx","PsSetLoadImageNotifyRoutine","PsRemoveLoadImageNotifyRoutine","ZwOpenProcess","PsGetProcessPeb","PsGetProcessSessionId","RtlRandomEx","KeBugCheckEx","RtlInitUnicodeString","_stricmp","NtQuerySystemInformation","ZwClose","ZwQueryValueKey","ZwOpenKey","RtlInitUnicodeString","ZwWaitForSingleObject","ZwDeviceIoControlFile","ZwOpenFile","_wcsnicmp","ZwEnumerateKey","ZwCreateEvent","MmGetSystemRoutineAddress","ZwCreateFile","__C_specific_handler","KeSetSystemAffinityThread","KeQueryActiveProcessors","KeQueryTimeIncrement","DbgBreakPointWithStatus","RtlTimeToTimeFields","ExSystemTimeToLocalTime","IoAllocateMdl","IoFreeMdl","MmUnlockPages","MmMapLockedPagesSpecifyCache","MmProbeAndLockPages","KeWaitForSingleObject","KeReleaseMutex","KeInitializeMutex","ExFreePoolWithTag","ExAllocatePool","KeRevertToUserAffinityThread","DbgPrint","KeQueryPerformanceCounter","ExAllocatePool","NtQuerySystemInformation","ExFreePoolWithTag","IoAllocateMdl","MmProbeAndLockPages","MmMapLockedPagesSpecifyCache","MmUnlockPages","IoFreeMdl","KeQueryActiveProcessors","KeSetSystemAffinityThread","KeRevertToUserAffinityThread","DbgPrint","KeQueryPerformanceCounter"],"Imports":["ntoskrnl.exe","ntoskrnl.exe","HAL.dll","ntoskrnl.exe","HAL.dll"],"InternalName":"","MD5":"f9844524fb0009e5b784c21c7bad4220","MachineType":"AMD64","MagicHeader":"50 45 0 0","OriginalFilename":"","Product":"","ProductVersion":"2.6.0.0","Publisher":"","RichPEHeaderHash":{"MD5":"ffdf660eb1ebf020a1d0a55a90712dfb","SHA1":"3e905e3d061d0d59de61fcf39c994fcb0ec1bab3","SHA256":"2b3f99a94b7a7132854be769e27b331419c53989ef42f686d6f5ba09ddefefd6"},"SHA1":"e6765d8866cad6193df1507c18f31fa7f723ca3e","SHA256":"7f4555a940ce1156c9bcea9a2a0b801f9a5e44ec9400b61b14a7b1a6404ffdf6","Sections":{".text":{"Entropy":6.870248263937928,"Virtual Size":"0x7870"},".rdata":{"Entropy":5.897354598934941,"Virtual Size":"0x96c"},".data":{"Entropy":0.7351616034595755,"Virtual Size":"0x80190"},".pdata":{"Entropy":7.583918822532478,"Virtual Size":"0x288"},"INIT":{"Entropy":7.689240999337947,"Virtual Size":"0x63c"},".gg0":{"Entropy":7.616860950546135,"Virtual Size":"0x2a80df"},".gg1":{"Entropy":2.618757537927313,"Virtual Size":"0x3b8"},".gg2":{"Entropy":7.230402020600491,"Virtual Size":"0x1975ac"},".reloc":{"Entropy":4.083360602517506,"Virtual Size":"0x1b0"},".rsrc":{"Entropy":3.1369885402408006,"Virtual Size":"0x260"}},"Signature":["Microsoft Windows Hardware Compatibility Publisher","Microsoft Windows Third Party Component CA 2014","Microsoft Root Certificate Authority 2010"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher","ValidFrom":"2022-06-07 18:08:06","ValidTo":"2023-06-01 18:08:06","Signature":"0a835e40cdb627d4f0a0d3dbbf64a46a05c132d0b5df9d11cd9c195d7037737057d57a342732ae68d67de47f460e7211c7c40dc29b0a079caff871c4834a9a2fc85e759de9b78659ad6fd79b7320e538e9ba5d52227ad67cc00b0a770ef662af3d743a558643ad89cfb015591709a69b6271a9b65db71898e7cb9964c6376dc474898301a6133198b486b518fdd9d7b9723dcffc441e026833f7c72e27986026c97b9184a0048b10d1fe6847ae467f02173f7a69120be780e5b6b9e6399402cc58735a31b537cc33578fbea443135a4a612359150bcf9ab316f6a9248bc71ef3f3480b9b3fa2341692bc3a121d80214688f7bd87d5ec56dcbd0ea61abf2c7ed2b739a07590adb596d401735d955f5f94c591d69ab4363a42f9fca549d439495711ff7990448c03724792ed4acf31f2b35b136c1b2f37aa82b1aabf7daf059dcb2e976e95311ec6e9cc53876dd09632cf512d39c801849a7c1088a565691953e07c7ff17b22518e982dd2dcc0feda8c834ca1f5e247aef1c3af5f13cd4b8cc1b6c0179bc876db88d677047c34366533e349796dbdea86389ad640710b7742ae8cc4ec88f10fa80ede4b1c93f81b55480fc8228216d54813df0327e74b3db9f3512a40c0568e4215827f9b7a2613deea72a7ec4df2def05e5559015049fe83edc83300526045cb128119e131b7d3573b268e24b0a25b9ad59f6301c8fc8f409322","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"3300000057ee4d659a923e7c10000000000057","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"fdc11a5676aed4e9cc0c09eeb7450dfb","SHA1":"4902077d9a05d4231b791d3b05bafa4a79132f03","SHA256":"5db56c23d83bf67c7152e28ad4a684a7372b4ae4f52afe7a81ce91eef94caec3","SHA384":"c952d7f0e0ea5216ce4400601fb7c0829f0f3fcd6eb2b5b9112fbe45d133e00c4abd660f8e1794f7ac4ef95123e2c0ab"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","ValidFrom":"2014-10-15 20:31:27","ValidTo":"2029-10-15 20:41:27","Signature":"96b5c33b31f27b6ba11f59dd742c3764b1bca093f9f33347e9f95df21d89f4579ee33f10a3595018053b142941b6a70e5b81a2ccbd8442c1c4bed184c2c4bd0c8c47bcbd8886fb5a0896ae2c2fdfbf9366a32b20ca848a6945273f732332936a23e9fffdd918edceffbd6b41738d579cf8b46d499805e6a335a9f07e6e86c06ba8086725afc0998cdba7064d4093188ba959e69914b912178144ac57c3ae8eae947bcb3b8edd7ab4715bba2bc3c7d085234b371277a54a2f7f1ab763b94459ed9230cce47c099212111f52f51e0291a4d7d7e58f8047ff189b7fd19c0671dcf376197790d52a0fbc6c12c4c50c2066f50e2f5093d8cafb7fe556ed09d8a753b1c72a6978dcf05fe74b20b6af63b5e1b15c804e9c7aa91d4df72846782106954d32dd6042e4b61ac4f24636de357302c1b5e55fb92b59457a9243d7c4e963dd368f76c728caa8441be8321a66cde5485c4a0a602b469206609698dcd933d721777f886dac4772daa2466eab64682bd24e98fb35cc7fec3f136d11e5db77edc1c37e1f6a4a14f8b4a721c671866770cdd819a35d1fa09b9a7cc55d4d728e74077fa74d00fcdd682412772a557527cda92c1d8e7c19ee692c9f7425338208db38cc7cc74f6c3a6bc237117872fe55596460333e2edfc42de72cd7fb0a82256fb8d70c84a5e1c4746e2a95329ea0fecdb4188fd33bad32b2b19ab86d0543fbff0d0f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"330000000d690d5d7893d076df00000000000d","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"83f69422963f11c3c340b81712eef319","SHA1":"0c5e5f24590b53bc291e28583acb78e5adc95601","SHA256":"d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae","SHA384":"260ad59ba706420f68ba212931153bd89f760c464b21be55fba9d014fff322407859d4ebfb78ea9a3330f60dc9821a63"}}],"Signer":[{"SerialNumber":"3300000057ee4d659a923e7c10000000000057","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","Version":1}]}],"Imphash":"c214aac08575c139e48d04f5aee21585","LoadsDespiteHVCI":"FALSE"},{"Authentihash":{"MD5":"2855f88dffa0bb68f988d5c116b336fb","SHA1":"169b81ce8a74d3a404384ad3e90ac3b053323d50","SHA256":"dcfab3c5f99c15cbb7df17c59914af551b90e0ed3c1dc040bad9927b12b67125"},"Company":"Sense5 CORP","Copyright":"Copyright (C) 2022","CreationTimestamp":"2022-08-09 01:58:08","Date":"","Description":"Sense5 Driver","ExportedFunctions":"","FileVersion":"2.5.0.0","Filename":"Sense5Ext.sys","ImportedFunctions":["IoGetCurrentProcess","ObReferenceObjectByHandle","ObfDereferenceObject","PsGetCurrentProcessId","NtBuildNumber","RtlTimeToTimeFields","ExSystemTimeToLocalTime","ZwCreateFile","ZwWriteFile","ZwClose","_snprintf","_vsnprintf","ZwQueryInformationFile","ZwReadFile","strcmp","strncmp","RtlCompareMemory","RtlImageNtHeader","RtlCompareUnicodeString","ExAllocatePoolWithTag","ExFreePoolWithTag","isupper","isdigit","tolower","strlen","_stricmp","strstr","wcscat","wcslen","RtlInitAnsiString","RtlQueryRegistryValues","RtlAnsiStringToUnicodeString","RtlCompareUnicodeStrings","ExAllocatePool","MmGetSystemRoutineAddress","PsCreateSystemThread","PsTerminateSystemThread","PsSetCreateProcessNotifyRoutineEx","PsSetLoadImageNotifyRoutine","PsRemoveLoadImageNotifyRoutine","ZwOpenProcess","PsGetProcessPeb","PsGetProcessSessionId","RtlRandomEx","KeBugCheckEx","RtlInitUnicodeString","_stricmp","NtQuerySystemInformation","ZwClose","ZwQueryValueKey","ZwOpenKey","RtlInitUnicodeString","ZwWaitForSingleObject","ZwDeviceIoControlFile","ZwOpenFile","_wcsnicmp","ZwEnumerateKey","ZwCreateEvent","MmGetSystemRoutineAddress","ZwCreateFile","__C_specific_handler","KeSetSystemAffinityThread","KeQueryActiveProcessors","KeQueryTimeIncrement","DbgBreakPointWithStatus","RtlTimeToTimeFields","ExSystemTimeToLocalTime","IoAllocateMdl","IoFreeMdl","MmUnlockPages","MmMapLockedPagesSpecifyCache","MmProbeAndLockPages","KeWaitForSingleObject","KeReleaseMutex","KeInitializeMutex","ExFreePoolWithTag","ExAllocatePool","KeRevertToUserAffinityThread","DbgPrint","KeQueryPerformanceCounter","ExAllocatePool","NtQuerySystemInformation","ExFreePoolWithTag","IoAllocateMdl","MmProbeAndLockPages","MmMapLockedPagesSpecifyCache","MmUnlockPages","IoFreeMdl","KeQueryActiveProcessors","KeSetSystemAffinityThread","KeRevertToUserAffinityThread","DbgPrint","KeQueryPerformanceCounter"],"Imports":["ntoskrnl.exe","ntoskrnl.exe","HAL.dll","ntoskrnl.exe","HAL.dll"],"InternalName":"","MD5":"4e1f656001af3677856f664e96282a6f","MachineType":"AMD64","MagicHeader":"50 45 0 0","OriginalFilename":"","Product":"","ProductVersion":"2.5.0.0","Publisher":"","RichPEHeaderHash":{"MD5":"ffdf660eb1ebf020a1d0a55a90712dfb","SHA1":"3e905e3d061d0d59de61fcf39c994fcb0ec1bab3","SHA256":"2b3f99a94b7a7132854be769e27b331419c53989ef42f686d6f5ba09ddefefd6"},"SHA1":"bc62fe2b38008f154fc9ea65d851947581b52f49","SHA256":"42b22faa489b5de936db33f12184f6233198bdf851a18264d31210207827ba25","Sections":{".text":{"Entropy":6.842945751587992,"Virtual Size":"0x78c0"},".rdata":{"Entropy":5.938498750442647,"Virtual Size":"0x96c"},".data":{"Entropy":0.7351616034595755,"Virtual Size":"0x80190"},".pdata":{"Entropy":7.636341499640352,"Virtual Size":"0x288"},"INIT":{"Entropy":7.669235447153766,"Virtual Size":"0x63c"},".gg0":{"Entropy":7.613447126933157,"Virtual Size":"0x2a6be8"},".gg1":{"Entropy":2.624443455503771,"Virtual Size":"0x3b8"},".gg2":{"Entropy":7.2332731109027,"Virtual Size":"0x195c4c"},".reloc":{"Entropy":4.1612553058698465,"Virtual Size":"0x178"},".rsrc":{"Entropy":3.1435087623386986,"Virtual Size":"0x260"}},"Signature":"","Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher","ValidFrom":"2022-06-07 18:08:06","ValidTo":"2023-06-01 18:08:06","Signature":"0a835e40cdb627d4f0a0d3dbbf64a46a05c132d0b5df9d11cd9c195d7037737057d57a342732ae68d67de47f460e7211c7c40dc29b0a079caff871c4834a9a2fc85e759de9b78659ad6fd79b7320e538e9ba5d52227ad67cc00b0a770ef662af3d743a558643ad89cfb015591709a69b6271a9b65db71898e7cb9964c6376dc474898301a6133198b486b518fdd9d7b9723dcffc441e026833f7c72e27986026c97b9184a0048b10d1fe6847ae467f02173f7a69120be780e5b6b9e6399402cc58735a31b537cc33578fbea443135a4a612359150bcf9ab316f6a9248bc71ef3f3480b9b3fa2341692bc3a121d80214688f7bd87d5ec56dcbd0ea61abf2c7ed2b739a07590adb596d401735d955f5f94c591d69ab4363a42f9fca549d439495711ff7990448c03724792ed4acf31f2b35b136c1b2f37aa82b1aabf7daf059dcb2e976e95311ec6e9cc53876dd09632cf512d39c801849a7c1088a565691953e07c7ff17b22518e982dd2dcc0feda8c834ca1f5e247aef1c3af5f13cd4b8cc1b6c0179bc876db88d677047c34366533e349796dbdea86389ad640710b7742ae8cc4ec88f10fa80ede4b1c93f81b55480fc8228216d54813df0327e74b3db9f3512a40c0568e4215827f9b7a2613deea72a7ec4df2def05e5559015049fe83edc83300526045cb128119e131b7d3573b268e24b0a25b9ad59f6301c8fc8f409322","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"3300000057ee4d659a923e7c10000000000057","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"fdc11a5676aed4e9cc0c09eeb7450dfb","SHA1":"4902077d9a05d4231b791d3b05bafa4a79132f03","SHA256":"5db56c23d83bf67c7152e28ad4a684a7372b4ae4f52afe7a81ce91eef94caec3","SHA384":"c952d7f0e0ea5216ce4400601fb7c0829f0f3fcd6eb2b5b9112fbe45d133e00c4abd660f8e1794f7ac4ef95123e2c0ab"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","ValidFrom":"2014-10-15 20:31:27","ValidTo":"2029-10-15 20:41:27","Signature":"96b5c33b31f27b6ba11f59dd742c3764b1bca093f9f33347e9f95df21d89f4579ee33f10a3595018053b142941b6a70e5b81a2ccbd8442c1c4bed184c2c4bd0c8c47bcbd8886fb5a0896ae2c2fdfbf9366a32b20ca848a6945273f732332936a23e9fffdd918edceffbd6b41738d579cf8b46d499805e6a335a9f07e6e86c06ba8086725afc0998cdba7064d4093188ba959e69914b912178144ac57c3ae8eae947bcb3b8edd7ab4715bba2bc3c7d085234b371277a54a2f7f1ab763b94459ed9230cce47c099212111f52f51e0291a4d7d7e58f8047ff189b7fd19c0671dcf376197790d52a0fbc6c12c4c50c2066f50e2f5093d8cafb7fe556ed09d8a753b1c72a6978dcf05fe74b20b6af63b5e1b15c804e9c7aa91d4df72846782106954d32dd6042e4b61ac4f24636de357302c1b5e55fb92b59457a9243d7c4e963dd368f76c728caa8441be8321a66cde5485c4a0a602b469206609698dcd933d721777f886dac4772daa2466eab64682bd24e98fb35cc7fec3f136d11e5db77edc1c37e1f6a4a14f8b4a721c671866770cdd819a35d1fa09b9a7cc55d4d728e74077fa74d00fcdd682412772a557527cda92c1d8e7c19ee692c9f7425338208db38cc7cc74f6c3a6bc237117872fe55596460333e2edfc42de72cd7fb0a82256fb8d70c84a5e1c4746e2a95329ea0fecdb4188fd33bad32b2b19ab86d0543fbff0d0f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"330000000d690d5d7893d076df00000000000d","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"83f69422963f11c3c340b81712eef319","SHA1":"0c5e5f24590b53bc291e28583acb78e5adc95601","SHA256":"d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae","SHA384":"260ad59ba706420f68ba212931153bd89f760c464b21be55fba9d014fff322407859d4ebfb78ea9a3330f60dc9821a63"}}],"Signer":[{"SerialNumber":"3300000057ee4d659a923e7c10000000000057","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","Version":1}]}],"Imphash":"c214aac08575c139e48d04f5aee21585","LoadsDespiteHVCI":"FALSE"}]}