{"Id":"75a933b4-82d8-4eb8-8ed5-a0a2178630a3","Tags":["fiddrv.sys"],"Verified":"FALSE","Author":"Michael Haag","Created":"2023-01-09","MitreID":"T1068","Category":"vulnerable driver","Commands":{"Command":"sc.exe create fiddrv.sys binPath=C:\\windows\\temp\\fiddrv.sys type=kernel && sc.exe start fiddrv.sys","Description":"","OperatingSystem":"Windows 10","Privileges":"kernel","Usecase":"Elevate privileges"},"Resources":["https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"],"Detection":[],"Acknowledgement":{"Handle":"","Person":""},"KnownVulnerableSamples":[{"Company":"","Date":"","Description":"","FileVersion":"","Filename":"fiddrv.sys","MachineType":"","OriginalFilename":"","Product":"","ProductVersion":"","Publisher":"","SHA1":"","Signature":[],"LoadsDespiteHVCI":"FALSE","Authentihash":{"MD5":"","SHA1":"8cc8974a05e81678e3d28acfe434e7804abd019c","SHA256":"97b976f7e7e5df7af0781bbbb33cb5f3f7a59efdd07995253b31de8123352a67"}},{"Company":"","Date":"","Description":"","FileVersion":"","Filename":"fiddrv.sys","MachineType":"","OriginalFilename":"","Product":"","ProductVersion":"","Publisher":"","SHA1":"","Signature":[],"LoadsDespiteHVCI":"FALSE","Authentihash":{"MD5":"","SHA1":"8cc8974a05e81678e3d28acfe434e7804abd019c","SHA256":"97b976f7e7e5df7af0781bbbb33cb5f3f7a59efdd07995253b31de8123352a67"}}]}