{"Id":"79e1e3d4-36d0-4325-8d9c-c6e69b6084da","Tags":["ImmunetUtilDriver.sys"],"Verified":"TRUE","Author":"Michael Haag","Created":"2026-04-17","MitreID":"T1068","Category":"vulnerable driver","Commands":{"Command":"sc.exe create ImmunetUtilDriver binPath=C:\\windows\\temp\\ImmunetUtilDriver.sys type=kernel && sc.exe start ImmunetUtilDriver","Description":"ImmunetUtilDriver.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.","Usecase":"Elevate privileges","Privileges":"kernel","OperatingSystem":"Windows 10"},"Resources":["https://github.com/magicsword-io/LOLDrivers/issues/325","https://github.com/KeServiceDescriptorTable/vulnerable-drivers"],"Detection":[],"Acknowledgement":{"Person":"","Handle":"@rainbowdynamix, @DbgPrint"},"KnownVulnerableSamples":[{"Filename":"ImmunetUtilDriver.sys","MD5":"413184d2547bba85b13b943df8200a81","SHA1":"1e3c0ca18950f8f0ad4f681753ae092d1916b4c1","SHA256":"2e270063af92a4f37d3f828dbb444c9a6277ea0d15a5b808e66e3b66ca5f5a58","Signature":"","Date":"","Publisher":"","Company":"Cisco Systems, Inc.","Description":"ImmunetUtilDriver.sys","Product":"Cisco Secure Endpoint","ProductVersion":"0, 7, 9, 517","FileVersion":"0, 7, 9, 517","MachineType":"AMD64","OriginalFilename":"ImmunetUtilDriver.sys","Authentihash":{"MD5":"c5634574f950a349c1246ec2b568a047","SHA1":"f89809c387295cadfab5b0a4804fe4f33f5c8ac4","SHA256":"df809d2034204821509da0c870b5f34d4f98d5c7e4a35531d9742b40df853305"},"RichPEHeaderHash":{"MD5":"6aaff7425538c6458910c49c098aa24d","SHA1":"63ab65d5f871abfa7f5af71d3b965380e6b6c18b","SHA256":"bf17c37e39062bccaa9ef8097fce40020b1485e308f719865668e4c0b2283d94"},"Sections":{".text":{"Entropy":6.339157685533367,"Virtual Size":"0x552f"},".rdata":{"Entropy":4.4023285497484075,"Virtual Size":"0x103c"},".data":{"Entropy":0.859311501040964,"Virtual Size":"0xb40"},".pdata":{"Entropy":4.27784323803933,"Virtual Size":"0x348"},"PAGE":{"Entropy":6.215303891228159,"Virtual Size":"0x1d0b"},"INIT":{"Entropy":5.152605124346265,"Virtual Size":"0x898"},".rsrc":{"Entropy":3.5507910179350337,"Virtual Size":"0x458"},".reloc":{"Entropy":4.340010174255562,"Virtual Size":"0x54"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2025-05-26 15:37:41","InternalName":"ImmunetUtilDriver.sys","Copyright":"Copyright Cisco Systems, Inc. All rights reserved.","Imports":["ntoskrnl.exe"],"ExportedFunctions":"","ImportedFunctions":["KeInitializeSpinLock","KeAcquireSpinLockRaiseToDpc","KeReleaseSpinLock","IofCompleteRequest","DbgPrint","_vsnprintf","IoGetDeviceObjectPointer","ObfDereferenceObject","IoAcquireVpbSpinLock","IoReleaseVpbSpinLock","IoEnumerateDeviceObjectList","ObReferenceObjectByName","IoDriverObjectType","KeGetCurrentIrql","ZwClose","PsGetCurrentProcessId","ZwOpenDirectoryObject","ZwQueryDirectoryObject","IoCreateFileSpecifyDeviceObjectHint","ObReferenceObjectByHandle","PsGetProcessId","KeStackAttachProcess","KeUnstackDetachProcess","PsLookupProcessByProcessId","ObOpenObjectByPointer","ZwDuplicateObject","IoFileObjectType","ExEventObjectType","ExSemaphoreObjectType","PsProcessType","PsThreadType","SeTokenObjectType","IoDeviceObjectType","RtlInitUnicodeString","MmGetSystemRoutineAddress","RtlGetVersion","IoCreateSymbolicLink","IoDeleteDevice","IoDeleteSymbolicLink","__C_specific_handler","_vsnwprintf","ObQueryNameString","ZwCreateKey","ZwSetSecurityObject","IoCreateDevice","RtlGetDaclSecurityDescriptor","RtlGetGroupSecurityDescriptor","RtlGetOwnerSecurityDescriptor","RtlGetSaclSecurityDescriptor","ExFreePoolWithTag","SeCaptureSecurityDescriptor","_snwprintf","RtlLengthSecurityDescriptor","SeExports","RtlCreateSecurityDescriptor","_wcsnicmp","ExAllocatePoolWithTag","wcschr","RtlAbsoluteToSelfRelativeSD","RtlAddAccessAllowedAce","RtlLengthSid","IoIsWdmVersionAvailable","RtlSetDaclSecurityDescriptor","ZwOpenKey","ZwSetValueKey","ZwQueryValueKey","RtlFreeUnicodeString"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher","ValidFrom":"2024-10-10 19:04:53","ValidTo":"2025-10-08 19:04:53","Signature":"3870e583035a72db64856d80e17833cd3badd24f19abf9a3d7c7485743dd875f69102820df4992d74f8fba0529be4e16f4234910064a3a1863299a29b82d3fac869915a368ec0e5d0127282221bce84db444d2e9974dc2761a2080a7bc7508d7064f32b2d97b0263d0d937527a8af95f18bcb54ec21a453ba35e55869791416a2a8813fcf95e889e65158dbb5b4cba653c989179947d286051ef6b0d56f41da479db08c6b93c44fa5c8399e126594cc53dfa756180607a1dd29559061d828b0ce2c5a462245ed0995a196ad96223b6eb1a787b4d10b5a7d4e3a130750103bc9c713fc8f32015273bb238b15aae25e4765d7ab81c5d3df82ef6a7d3c2e7a61dab024ff02df6876a86ec7198aa6e28c8e69a015129a717b1036113911f0aeefa8d05081974d026196f24bc1e4ef942599fafbd1b2c316bda73237f1822296888df2344c92b08c363976beb7020242b3069e6691f19e715e1d1a19ddc03235263c9bb7b8390145af57603105ced358f394547e3be96718835917234eb7fd7134d9fb605656717ed6b15f0583068c84c6c01abf31cc1df1fe7c4d2935590e6017cf8cc5635e1cd7054240fd0059f168e90ec1a49f24e0f050034d99e4aa6599a64d280d00ea8af57d3125caddb342a0b2c160a2f95d97e6045e69dc1c1b3fa56dfd40380ce60536a59750edf0069dc7c27f8ccc8f073b46d169b8fed1fd40ac6f00c","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"330000006e1229856f0ade6cfc00000000006e","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"3066a9830894e57ce6e47f7a6b58b84f","SHA1":"ce441ecd2f11e400515a85d5a592da38f950f3dc","SHA256":"3e30a731a3b620db0971ecd743ecd312bcdf14c82b9bdc9918102bacbf70520d","SHA384":"68c6537d64e3a4f02a2c1d04257c13ab1def23c9c54bafc434176be50a411a75c118c9f8edc81f97b8a1db2dc1d009e3"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","ValidFrom":"2014-10-15 20:31:27","ValidTo":"2029-10-15 20:41:27","Signature":"96b5c33b31f27b6ba11f59dd742c3764b1bca093f9f33347e9f95df21d89f4579ee33f10a3595018053b142941b6a70e5b81a2ccbd8442c1c4bed184c2c4bd0c8c47bcbd8886fb5a0896ae2c2fdfbf9366a32b20ca848a6945273f732332936a23e9fffdd918edceffbd6b41738d579cf8b46d499805e6a335a9f07e6e86c06ba8086725afc0998cdba7064d4093188ba959e69914b912178144ac57c3ae8eae947bcb3b8edd7ab4715bba2bc3c7d085234b371277a54a2f7f1ab763b94459ed9230cce47c099212111f52f51e0291a4d7d7e58f8047ff189b7fd19c0671dcf376197790d52a0fbc6c12c4c50c2066f50e2f5093d8cafb7fe556ed09d8a753b1c72a6978dcf05fe74b20b6af63b5e1b15c804e9c7aa91d4df72846782106954d32dd6042e4b61ac4f24636de357302c1b5e55fb92b59457a9243d7c4e963dd368f76c728caa8441be8321a66cde5485c4a0a602b469206609698dcd933d721777f886dac4772daa2466eab64682bd24e98fb35cc7fec3f136d11e5db77edc1c37e1f6a4a14f8b4a721c671866770cdd819a35d1fa09b9a7cc55d4d728e74077fa74d00fcdd682412772a557527cda92c1d8e7c19ee692c9f7425338208db38cc7cc74f6c3a6bc237117872fe55596460333e2edfc42de72cd7fb0a82256fb8d70c84a5e1c4746e2a95329ea0fecdb4188fd33bad32b2b19ab86d0543fbff0d0f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"330000000d690d5d7893d076df00000000000d","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"83f69422963f11c3c340b81712eef319","SHA1":"0c5e5f24590b53bc291e28583acb78e5adc95601","SHA256":"d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae","SHA384":"260ad59ba706420f68ba212931153bd89f760c464b21be55fba9d014fff322407859d4ebfb78ea9a3330f60dc9821a63"}}],"Signer":[{"SerialNumber":"330000006e1229856f0ade6cfc00000000006e","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","Version":1}]}],"LoadsDespiteHVCI":"TRUE","Imphash":"a16e9870c5694171719f826d2e37a9a3"}]}