← Back to driver explorer
Driver intelligenceVulnerableVerified
STProcessMonitor.sys
Safetica STProcessMonitor / ProcessMonitorDriver.sys exposes process-termination functionality through vulnerable IOCTL paths documented in public BYOVD research. The tracked samples include the 11.26.18.0 build and the legacy 11.11.4.0 build; public research notes that affected versions can be abused to terminate endpoint security processes from kernel context.
Known samples 2
0 recorded TRUE · 0 recorded FALSE · 2 unknown for loading despite HVCI. Results apply to individual samples.
STProcessMonitor.sysSample 1 · HVCI unknown
- MD5
5761bd63da03686fc480245da7bd1e9f- SHA1
68fec379f2ae76c3d2ce913f7be650cea1d06990- SHA256
5b4f59236a9b950bcd5191b35d19125f60cfb9e1a1e1aa2e4f914b6745dde9df- Imphash
51777abf89572dc6d0ba931ade6ae5b9- Authentihash MD5
7590bc612d1cb940d6acf2d7ae384638- Authentihash SHA1
01bf6090818731e8121674a339a5f22cb18cf41d- Authentihash SHA256
0376d4554b4828a7e3721327cb4c9977301c02eb8c50d10d376d3be623d71e3a- Machine
- AMD64
- Version
- 11,26,18,0
- Publisher
- Microsoft Windows Hardware Compatibility Publisher
ProcessMonitorDriver.sysSample 2 · HVCI unknown
- MD5
485a04675df7cf40a8865706e003eb25- SHA1
711ef221526997039e804a18db9647c91680bbe2- SHA256
70bcec00c215fe52779700f74e9bd669ff836f594df92381cbfb7ee0568e7a8b- Imphash
ce19d9c0ab826dbae6f1376e7c9ef40f- Authentihash MD5
30cdcd7b597209ca662a0cacce2e7b28- Authentihash SHA1
e66c967dc212c7e96b771016e2fff82a2e281824- Authentihash SHA256
ea80d2e65b03ea918f918d60cc8397aa4ee11eeb7bf679c7813311ff32ed5c81- Machine
- AMD64
- Version
- 11,11,4,0
- Publisher
- Safetica Technologies
Recorded command
sc.exe create STProcessMonitor binPath=C:\windows\temp\STProcessMonitor.sys type=kernel && sc.exe start STProcessMonitorDisable security tools · Privileges: kernel · OS: Windows 10