{"Id":"8d14d798-338f-471e-bacb-6d9371c0f529","Tags":["dbutil.sys"],"Verified":"FALSE","Author":"Michael Haag","Created":"2023-01-09","MitreID":"T1068","Category":"vulnerable driver","Commands":{"Command":"sc.exe create dbutil.sys binPath=C:\\windows\\temp\\dbutil.sys type=kernel && sc.exe start dbutil.sys","Description":"","OperatingSystem":"Windows 10","Privileges":"kernel","Usecase":"Elevate privileges"},"Resources":["https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"],"Detection":[],"Acknowledgement":{"Handle":"","Person":""},"KnownVulnerableSamples":[{"Company":"","Date":"","Description":"","FileVersion":"","Filename":"dbutil.sys","MachineType":"","OriginalFilename":"","Product":"","ProductVersion":"","Publisher":"","SHA1":"","Signature":[],"LoadsDespiteHVCI":"FALSE","Authentihash":{"MD5":"","SHA1":"485c0b9710a196c7177b99ee95e5ddb35b26ddd1","SHA256":"96ee751f7c38731e97773e07e0f13f4dd361af9aaa1d30b41652c2e6efc3fb3e"}},{"Company":"","Date":"","Description":"","FileVersion":"","Filename":"dbutil.sys","MachineType":"","OriginalFilename":"","Product":"","ProductVersion":"","Publisher":"","SHA1":"","Signature":[],"LoadsDespiteHVCI":"FALSE","Authentihash":{"MD5":"","SHA1":"485c0b9710a196c7177b99ee95e5ddb35b26ddd1","SHA256":"96ee751f7c38731e97773e07e0f13f4dd361af9aaa1d30b41652c2e6efc3fb3e"}},{"Company":"","Date":"","Description":"","FileVersion":"","Filename":"dbutil.sys","MachineType":"","OriginalFilename":"","Product":"","ProductVersion":"","Publisher":"","SHA1":"","Signature":[],"LoadsDespiteHVCI":"FALSE","Authentihash":{"MD5":"","SHA1":"e3c1dd569aa4758552566b0213ee4d1fe6382c4b","SHA256":"fe4270a61dbed978c28b2915fcc2826d011148dcb7533fa8bd072ddce5944cef"}},{"Company":"","Date":"","Description":"","FileVersion":"","Filename":"dbutil.sys","MachineType":"","OriginalFilename":"","Product":"","ProductVersion":"","Publisher":"","SHA1":"","Signature":[],"LoadsDespiteHVCI":"FALSE","Authentihash":{"MD5":"","SHA1":"e3c1dd569aa4758552566b0213ee4d1fe6382c4b","SHA256":"fe4270a61dbed978c28b2915fcc2826d011148dcb7533fa8bd072ddce5944cef"}}]}