{"Id":"724d7989-dfce-4bb2-9beb-dee15df5b790","Tags":["skill.sys"],"Verified":"TRUE","Author":"Michael Haag","Created":"2023-07-22","MitreID":"T1068","CVE":[""],"Category":"vulnerable driver","Commands":{"Command":"","Description":"Confirmed vulnerable driver from Microsoft Block List","OperatingSystem":"Windows","Privileges":"kernel","Usecase":"Elevate privileges"},"Resources":["https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c"],"Detection":[{"type":"","value":""}],"Acknowledgement":{"Handle":"","Person":""},"KnownVulnerableSamples":[{"Authentihash":{"MD5":"37458813b5115cbf06552da28fefbbbb","SHA1":"1d1cafc73c97c6bcd2331f8777d90fdca57125a3","SHA256":"faa08cb609a5b7be6bfdb61f1e4a5e8adf2f5a1d2492f262483df7326934f5d4"},"Company":"","Copyright":"","CreationTimestamp":"2016-09-05 02:43:33","Date":"","Description":"","ExportedFunctions":"","FileVersion":"","Filename":"","ImportedFunctions":["IoDeleteSymbolicLink","RtlInitUnicodeString","IofCompleteRequest","MmGetSystemRoutineAddress","IoCreateSymbolicLink","IoCreateDevice","IoDeleteDevice"],"Imports":["ntoskrnl.exe"],"InternalName":"","MD5":"2b36d61f6e7420977648ed27e784adf1","MachineType":"AMD64","MagicHeader":"50 45 0 0","OriginalFilename":"","PDBPath":"","Product":"","ProductVersion":"","Publisher":"","RichPEHeaderHash":{"MD5":"b2f23c03be4553a744ff25735a80073c","SHA1":"2703d60c8f12df9d6adf5ae475bfeb1786486888","SHA256":"46ffd109664b6694974986a39d508002d564434d60a0fb9f861401f2cb2c83f1"},"SHA1":"c92a386622f04a5733cb238d33cedea4272a3f85","SHA256":"0c1b21978c6aef881f056f7b9c909b56488019459ed256511d78a4588d1aa7a4","Sections":{".text":{"Entropy":5.848826218029174,"Virtual Size":"0x4e0"},".data":{"Entropy":0,"Virtual Size":"0xc0"},".pdata":{"Entropy":3.006469661076665,"Virtual Size":"0x48"},".info":{"Entropy":1.3665783978789787,"Virtual Size":"0xa0"},"INIT":{"Entropy":4.123682579107587,"Virtual Size":"0x114"}},"Signature":"","Signatures":{},"Imphash":"45bfe170e0cd654bc1e2ae3fca3ac3f4","LoadsDespiteHVCI":"FALSE"}]}