{"Id":"c366ee89-97ae-4523-b635-e05769384bd3","Tags":["whql.sys"],"Verified":"TRUE","Author":"Michael Haag","Created":"2026-04-17","MitreID":"T1068","Category":"vulnerable driver","Commands":{"Command":"sc.exe create whql binPath=C:\\windows\\temp\\whql.sys type=kernel && sc.exe start whql","Description":"whql.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.","Usecase":"Elevate privileges","Privileges":"kernel","OperatingSystem":"Windows 10"},"Resources":["https://github.com/magicsword-io/LOLDrivers/issues/325","https://github.com/KeServiceDescriptorTable/vulnerable-drivers"],"Detection":[],"Acknowledgement":{"Person":"","Handle":"@rainbowdynamix, @DbgPrint"},"KnownVulnerableSamples":[{"Filename":"whql.sys","MD5":"5ea6bc6b8a59d98338b8d94748491838","SHA1":"d7a79e147b2b4bd0e0675795c48a3e43c805fb9a","SHA256":"412564937dea61ad443a3f50a0f7586aed1bf68795e9af184606804357499cea","Signature":"","Date":"","Publisher":"","Company":"","Description":"","Product":"","ProductVersion":"","FileVersion":"","MachineType":"AMD64","OriginalFilename":"","Authentihash":{"MD5":"d2ab2460dd07e0db1990f45e99e4df5e","SHA1":"2435dc624414a2026077fdcd13c3ebfb2043f08d","SHA256":"78c77db3e814b83f60f77f9499d8a1a55ed6f85a3e618b4545b6b60d9e17a665"},"RichPEHeaderHash":{"MD5":"803a83db63ca031b217a73cd2e07003e","SHA1":"fbfef185f333654105008468c825c670f349eb4c","SHA256":"032e2cbddb681ff87ccd3487fb0a173e9e7891dcf3c4d7a6019a2be44cc4f745"},"Sections":{".text":{"Entropy":6.241904974404491,"Virtual Size":"0x2464"},".rdata":{"Entropy":4.32612905150401,"Virtual Size":"0xca8"},".data":{"Entropy":0.6139218479127164,"Virtual Size":"0x388"},".pdata":{"Entropy":3.984648202480125,"Virtual Size":"0x210"},"INIT":{"Entropy":4.887052595871101,"Virtual Size":"0x49a"},".reloc":{"Entropy":3.595787133598321,"Virtual Size":"0x34"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2026-03-24 12:50:28","InternalName":"","Copyright":"","Imports":["ntoskrnl.exe","WDFLDR.SYS"],"ExportedFunctions":"","ImportedFunctions":["IoDeleteDevice","IoDeleteSymbolicLink","__C_specific_handler","KeGetCurrentIrql","IofCompleteRequest","RtlGetVersion","KeClearEvent","KeSetEvent","ExAllocatePool2","ExFreePoolWithTag","MmBuildMdlForNonPagedPool","MmMapLockedPagesSpecifyCache","IoCreateSymbolicLink","IoAllocateMdl","IoFreeMdl","IoGetCurrentProcess","ObfReferenceObject","ObfDereferenceObject","KeStackAttachProcess","KeUnstackDetachProcess","MmGetSystemRoutineAddress","ZwQuerySystemInformation","IoCreateDevice","RtlCopyUnicodeString","DbgPrintEx","KeWaitForSingleObject","KeInitializeEvent","DbgPrint","MmUnmapLockedPages","RtlInitUnicodeString","WdfVersionUnbind","WdfLdrQueryInterface","WdfVersionBind","WdfVersionUnbindClass","WdfVersionBindClass"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher","ValidFrom":"2025-11-13 19:59:40","ValidTo":"2026-11-10 19:59:40","Signature":"7027f4dae4e1916c6c1497dc353dcefdef09044faf0b41df8e9cbf316e9efe85e7d6e013218e8a26fcc429326b9ba45d793be971f810a2d94ac47082bb5746f6791d6852fd1a86680337b65509dfe78631e8f603aef366e2f07716d0c65ed188ca0c748c44979be74293858208351ceb59cae059dc2acaa6050db2822f86570b750dcd892f5972680f4a46d1152c2f7e345bcf3a2dd14cc5aea9099e00d3b8be5b07949ccb72d8b7484b24764e7c29704b1001a7b837daa21c76d690e1cfa99ff7324d2f11fe30cf83b79eaac30a776e64c20831fcc1256199ac86d2cb0e8e39f85a1330f8fbfe4fad14d98323ef9d9f3a452badb2e17326e920d235541e7a1f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"330000013d8f4dd77862f0ad2000000000013d","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"d98977d115c14597f0bbce9e377d9d36","SHA1":"3c5bed71f114313ca3ffbe905002568e47a13138","SHA256":"642865a6fb047124c66954823d2726901f6288c2a3a1c9062faad0bdb24f738c","SHA384":"65b73fb035c9d2c72325c92641b097a7cf3c34bbdf43137d18a136988635b7c391e46a68bdae71cbfa0688abb80cd0be"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2012","ValidFrom":"2012-04-18 23:48:38","ValidTo":"2027-04-18 23:58:38","Signature":"5a8a67daccd5fd0d264177bf0a4678b4b3de12692b7723c2652f015fd203f461ba509d2e8c3972f36c3e6ab11e766decb7f382dcccbbc56970287366173f54ebee011648c446d91b80ae813a8d0f796d68b09eea2d3f39d3ca387ebd5e7c086e19dcc6c2f438336861e2524783e1000156d2bacb878205310a418b4ee77f5f5fed5fd3392d45eba213bffd1ec298417161165fc80a70257c59693124e471e70abb0417f79f721ec9d2bb1abe3d02fe090cb243b4591a99539396215fe0d6b72601429536ac27fdbef48577683d18bdf4be98882211865216f345ec0397107087a37043713cdbc98603170cf5735bc67de15c64edd7c548d7ed32e2d1aad3cfa7f6574e61f977eb67f288b3de00da038fd08a34373e1dd862b8d2b1f3e12f8b723b81967c6ffcec667672601b24f2a0896d5b6d002eef28dd868705c2b4b9e5be64c22af24a155c98e2c42785ff52e3627e0fb2020bd766c70ab2d33d200414503259830a7d9bed5a38120152ba2f5e20728e4af1fde771028c3be107bec973f4dd47d8b4efb4a4b330b9893e76cab90098567eabea8ab8a5d038ab6977130b142fe9aa411ff7babd3a2b348aee0aab63e663f788248e200d2b3b9de3c24952ac9f1f0e393b5dd46e506ae67d523aaa7c3315290d265e0158a74ea93d7a846f743f609fe4324f3600af6d71d33ea646655f8174f1fec171da4ca0415a82ddf11f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"610baac1000000000009","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"a569061297e8e824767dbc3184a69bea","SHA1":"adbb26a587a8f44b4fccaecb306f980d1c55a150","SHA256":"cec1afd0e310c55c1dcc601ab8e172917706aa32fb5eaf826813547fdf02dd46","SHA384":"e947cac936803f5683196e4ff1b259096073395d0b908522ddce90d57597c9f7b57f7ddcdbe021ba863d843c340da8ba"}}],"Signer":[{"SerialNumber":"330000013d8f4dd77862f0ad2000000000013d","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2012","Version":1}]}],"LoadsDespiteHVCI":"TRUE","Imphash":"662750337cd06c9bfbf0f6b1e63f760b"}]}