{"Id":"de4bebdc-0f92-4855-989a-ac2cd1224190","Tags":["MonProcessControl.sys"],"Verified":"TRUE","Author":"Michael Haag","Created":"2026-10-19","MitreID":"T1562.001","Category":"vulnerable driver","Commands":{"Command":"sc.exe create MonProcessControl binPath=C:\\windows\\temp\\MonProcessControl.sys type=kernel && sc.exe start MonProcessControl","Description":"HONOR's MonProcessControl.sys version 1.0.0.1 exposes process termination through IOCTL 0x22400C on \\\\.\\MonProcessControl. Jehad Abudagga's KillerLand research publishes a proof of concept that submits a four-byte target PID and reports termination of protected AV/EDR processes. Static analysis confirms that the handler opens the supplied PID with ZwOpenProcess using a kernel handle and calls ZwTerminateProcess. The driver restricts device access to administrators and SYSTEM and checks that the calling process's image path ends with \\HONOR\\MagicAnimation\\MagicSpaceTurbo.exe. The published proof of concept copies itself to that path before opening the device, satisfying this path-based check. Protected-process termination is reported by the researcher and was not independently reproduced here.","Usecase":"Terminate caller-selected processes from kernel mode to impair security tools.","Privileges":"Administrator required to load the driver, access its device, and use the published proof of concept.","OperatingSystem":"Windows"},"Resources":["https://github.com/redteamfortress/KillerLand","https://github.com/redteamfortress/KillerLand/blob/efb10e494ecabfc42fe1a41ecf2ba79964cb8a91/README.md","https://github.com/redteamfortress/KillerLand/blob/efb10e494ecabfc42fe1a41ecf2ba79964cb8a91/2.%20MonProcessControl/monproc_poc.c","https://github.com/redteamfortress/KillerLand/blob/efb10e494ecabfc42fe1a41ecf2ba79964cb8a91/2.%20MonProcessControl/MonProcessControl.sys"],"Acknowledgement":{"Person":"Jehad Abudagga","Handle":"@j3h4ck"},"Detection":[],"KnownVulnerableSamples":[{"Filename":"MonProcessControl.sys","MD5":"feacb824f30def7732b2b1c2b000ac22","SHA1":"019f2ec8f50605d880886cc241139e52159578e3","SHA256":"0e1cc4f205ddc6b78578de2da209ba3ba1f16fac482f4042bbd02036fc470f04","Imphash":"5d9a58cb1f98a21b421e3c1f3426064e","Authentihash":{"MD5":"02dc6130fca94a9741a37b56261c66ca","SHA1":"4af78ec3cba298ababed50263d4b70b5cba4e93f","SHA256":"68ad66ec793df37a7cae25dba4b6dd5e45624409ae81607eff419ae4d59d7384"},"RichPEHeaderHash":{"MD5":"18e9cd08fb645e92ff3fe97c327f9435","SHA1":"b2116e875c3b18e16f846ff3e90b8d2866811348","SHA256":"6b9a4f235ee865b3035bc0c03e122608a0a8ec1f695d823eff4a8302c5afdcff"},"Sections":{".text":{"Entropy":6.375374323574863,"Virtual Size":"0x1dc9"},".rdata":{"Entropy":4.278506830010836,"Virtual Size":"0xd44"},".data":{"Entropy":1.2745467871770655,"Virtual Size":"0x2340"},".pdata":{"Entropy":4.281116980873497,"Virtual Size":"0x39c"},"PAGE":{"Entropy":6.288306994918375,"Virtual Size":"0x2100"},"INIT":{"Entropy":5.425033959004694,"Virtual Size":"0x7ca"},".rsrc":{"Entropy":3.285084810123525,"Virtual Size":"0x3b0"},".reloc":{"Entropy":3.8132924776753416,"Virtual Size":"0x38"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2026-07-21 08:56:07","Description":"MonProcessControl","Company":"Honor Device Co., Ltd.","InternalName":"MonProcessControl","OriginalFilename":"MonProcessControl.sys","FileVersion":"1.0.0.1","Product":"Honor","ProductVersion":"1.0.0.1","Copyright":"Copyright (C) Honor Device Co., Ltd. 2016-2020. All rights reserved.","MachineType":"AMD64","Imports":["ntoskrnl.exe"],"ExportedFunctions":"","ImportedFunctions":["DbgPrint","ZwClose","ZwOpenProcess","ZwSetInformationProcess","RtlInitUnicodeString","ExFreePoolWithTag","IofCompleteRequest","IoCreateSymbolicLink","IoDeleteDevice","IoDeleteSymbolicLink","PsGetCurrentProcessId","InitSafeBootMode","MmGetSystemRoutineAddress","RtlFreeUnicodeString","RtlGetVersion","KeGetCurrentIrql","ExAllocatePool2","ObReferenceObjectByHandle","ZwTerminateProcess","__C_specific_handler","RtlCompareUnicodeStrings","KeInitializeEvent","KeSetEvent","ExAcquireFastMutex","ExReleaseFastMutex","ObfDereferenceObject","PsSetCreateProcessNotifyRoutineEx","ExEventObjectType","RtlEqualUnicodeString","ZwQueryValueKey","ZwSetSecurityObject","IoDeviceObjectType","IoCreateDevice","ObOpenObjectByPointer","RtlGetDaclSecurityDescriptor","RtlGetGroupSecurityDescriptor","RtlGetOwnerSecurityDescriptor","RtlGetSaclSecurityDescriptor","SeCaptureSecurityDescriptor","_snwprintf","RtlLengthSecurityDescriptor","SeExports","RtlCreateSecurityDescriptor","_wcsnicmp","ExAllocatePoolWithTag","wcschr","RtlAbsoluteToSelfRelativeSD","RtlAddAccessAllowedAce","RtlLengthSid","IoIsWdmVersionAvailable","RtlSetDaclSecurityDescriptor","ZwOpenKey","ZwSetValueKey","ZwCreateKey"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"OU=GlobalSign Root CA , R3, O=GlobalSign, CN=GlobalSign","ValidFrom":"2018-09-19 00:00:00","ValidTo":"2028-01-28 12:00:00","Signature":"2370e9cfe2bef559ae94426fc44333aacd3f3ab96417f262064b48f140880617a1feabd15f3cc633f2f38edd1f1d3ecc1a6099820bacc7fc7e9a872aa57d0fa657eeac3b6a85d6debd4063f8ada6c888b012fcf641df0f09971e38ea539fbe05f43eead39f501276be098bc20b487d1e2e51f68d53d3ab1f401b8a8eed7dfb4f7956705f0cd38e1bb3a7700d372b9795abdae0126b1c40cec5c77eedc26258ec77ed7322c28af5864388adea136efdd8fe422fb97d5ead18ef9490ca3d27ab26949975c7cbd37bf7ca4cd3af5121925b847d2b9f153f74cb51e89e830e166f1be746ce23bdf9e4a28bd2396baa791c912ce261242d8e2a487090c41ec5e8e070","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"01ee5f169dff97352b6465d66a","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"51c3959a45cecf3d21a3effb05762573","SHA1":"ecfcd25fd0525448a74875ba271566bc0bfbf061","SHA256":"de1da11668f0a8d5e13346ed3ab2755f5d25bebffcfd1d0bde5b9f87bc292c91","SHA384":"f0eab75baf1f24a53d63bd795cd07292a312f603513c8cb0f40fe5acbdb477ed72607d309fad21471a16f6223fb3a838"}},{"Subject":"C=BE, O=GlobalSign nv,sa, CN=GlobalSign Code Signing Root R45","ValidFrom":"2020-07-28 00:00:00","ValidTo":"2029-03-18 00:00:00","Signature":"acf7cc158b3079a81d0b28881909d71c7ffe86bd7b5a336e0d670e7b62d9e1185cb0bd135d1d23ae39507637aa44fd5f01235986564cccadbc64131430a420a8e03fe89c72dc7ef3d80c23baa82daa3cf6ec9f87310765f539a7518275e1f22f97f6d1e165968364fea11d51fbb5249bf5d27769bc852c5cfa5877d1aea7b10be2d677bba9b4344aa96f3df4f30d955de6f97a45b02517312edbf70f68e6831fa9f7e5d49d988cd3614b2fc3287e7ade930eb47da00a6d92c4b4663f7da758eeacf7ecc30801ab38fc0a1ca9c597b288c8090219f65c9a1af14d6c30d4b306ab0060480d78abcf17ad9293622077756cbdc832b4dc4debd9dfc1909629bdc17f","SignatureAlgorithmOID":"1.2.840.113549.1.1.12","IsCertificateAuthority":true,"SerialNumber":"7803184245708a41cf6f01b8eeb4a954","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"a33260428269bc902bc1cd280e4b1837","SHA1":"254209ca172cffcc67bd2a88996556d2f09538f0","SHA256":"a67411358594f2cf016741a63fd49f36de917f86531b3e3a43eb6a421c654868","SHA384":"fec727af43d1569995cea26e8eb97167165842a5b185304425a92c03b71254c5d51222837515f33e60cb8ed2e8c625ba"}},{"Subject":"C=BE, O=GlobalSign nv,sa, CN=GlobalSign GCC R45 EV CodeSigning CA 2020","ValidFrom":"2020-07-28 00:00:00","ValidTo":"2030-07-28 00:00:00","Signature":"2575a009c939bab7a139892f189fabd6eb1d4be8947c0d07689b1c9def71b6176a6b024fb33f864587cc659b4ce35806022266d56102c5638fd4a2f1b65e250b7796e9cd7140338829eceef3a26dbc4db53e064bc97333ca08142d3d4ce8b0ba75a6742da4583a6c1349f8a5150a149685b16a68342542af9656f410fa247df12b72c116e16bebe6a998c73e5af4d0189dfd74978677462a3d237d28738aaeef2b1b9abf6c53a7149e3c8771c05e8ec8fbd32a9233ea574d5e075ecac118ac812d1a21fa6ecf97617bdf717a3aca63f7d530443732febb4385dcbafca6ca33192b776ddbcb05f07e5f752ea2b6bf35aa3663c9ce64d9bdfcbc2cf3495600c8122bc627bb37af57efc4cf1e29c4f4e22dce2a61cf57edf50a40e2f518d61ee9902fcad3875f938a481a111de537859f2e66629a5e814e95ac555743dc538b257e3c610f8a0bbaf53fa6d78ef704565e21bb9fd76a7180bf96de7203d8d8222bf327164f38e851400cae92efbe3d7df780c64c36578495a7841548300e5227088d8ea2bd22c719c9a6ca0ea87a36db6aba615f112495a4e28e68ee19a949995ed0b434bdd6f940c710973152393529118724d3c4fba963cb7748d5fa62fc24e0047a4ed0e46edece9e385026f4217165d70925d4c907007ab8c7f377e8c5d4e255d0d31ef67f52e2498db911720c88442633660144dfe4330e21de62894807daf5","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"77bd0e05b7590bb61d4761531e3f75ed","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"65fd1dac1f115d9507f4e1840c8cb36a","SHA1":"c7cf5607e19b22fe60c055e71d9b555d70f71f66","SHA256":"d9c7db0b704f07089440c56e69a0f31d730edf77cfbf7514630e8b5390a270fe","SHA384":"defe810317bd1215b4d1ee0ec8a5fb38b21d094ef1173cae670956cd899232638e4f9473fd947bd550a4a77300bbb2ab"}},{"Subject":"BUSINESS_CATEGORY=Private Organization, serialNumber=91440300MA5G49LC9K, JURISDICTION_OF_INCORPORATION_C=CN, JURISDICTION_OF_INCORPORATION_SP=Guangdong, JURISDICTION_OF_INCORPORATION_L=Shenzhen, C=CN, ST=Guangdong, L=Shenzhen, STREET_ADDRESS=福田区香蜜湖街道东海社区红荔西路8089号深业中城6号楼A单元3401, O=Honor Device Co., Ltd., CN=Honor Device Co., Ltd.","ValidFrom":"2023-12-14 09:34:53","ValidTo":"2026-11-28 09:15:10","Signature":"598eeb133d94263336a451a0458319572beb8b2d511efb9e4bc1c4b44afa7464883693bb8833df77189bae91d01a5a7bf3837e0fc3eec457b294a071c93ebf719b48a8ca2d095f0d73f670c8b7081096d969e8af368c91d3c814f38c5f8b8a0da78e803c22f973b83fa17167d492ce3190be35c356ea290a2241b540220b4b33b47cea8870827cc08cdb9557cd66a75082a086ec40d0318d65c28c2051b2baadded9eb47332107c1a03d8346e540d3d6bd0d3dac8b3108f6a0ddb236cb716c0ac16c6160d23d14487ae4d8d535b07645394b4619793f62a704608d8cbd097ca169d085d18c8e776617e7a7be94968e662ac998890b491080950b6cca7f425ac05147910b579a53dae0dad1576d80cdd73c51318f27c42aaa11cf684602009c98f7fddcd33130cc7533963cf4913cf577943ec98e4053083226906ead774db80c23aa7721805e6b0004606f10e676ba165e969ca9b3c1eaba944ad920457f31f46e234c7b5af7fac14df216f148f6d9df08bf38be5a4e19aa2b45c48956e5075663cd455e942d8847c370c15affb6e6691b280d6b7606ff33e9fcbd58cbfbafdba14d6c7336fd7d77fddae2b309286ea3dc5cec07935b39128605d26bec11ff70a05f4f5e861c886597208e698d6dcf46c02761d6eeaebe4c1c2c3a96f77d093853a0574da8f09379a02c84c3a07770491489b255ac3ed86d1a5372a0d41eaadb","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"032fba56284f12315bb78036","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"b7fc4b809e20b3f13cc3ba9957e7604b","SHA1":"99db55c393dbc2e903f0355bf1350c005b8ab1c7","SHA256":"7febf29a3eca70c31f18a3fd3136f9dd4be2a580d4a7bb4e280851bcf217e565","SHA384":"5a9dbc083f686dfd54d7081f089bc2eadb97ad6dce45b6d2654310332cd084b221c109f3d04472280bfb31a873aad280"}}],"Signer":[{"SerialNumber":"032fba56284f12315bb78036","Issuer":"C=BE, O=GlobalSign nv,sa, CN=GlobalSign GCC R45 EV CodeSigning CA 2020","Version":1}]}]}]}