LOLDriversTHE DRIVER THREAT CATALOG
← Back to driver explorer
Driver intelligenceVulnerableVerified

shield.sys

Horizon DataSys Shield drivers expose IOCTL functionality reported to provide arbitrary kernel read/write primitives.

UUID / 0e272ccf-81e5-4612-95d2-365e7ded6eacADDED / 2026-06-16AUTHOR / Michael Haag

Known samples 3

0 recorded TRUE · 0 recorded FALSE · 3 unknown for loading despite HVCI. Results apply to individual samples.

shield.sysSample 1 · HVCI unknown
MD5
97d6d9e9164354e40b5bcc828c6da3df
SHA1
4d0f2a70ce5cd0c868454de9afe9b4b09fcef5df
SHA256
b11db76aeab05f29e8f5d51cdfe70898a46fbd50a1245ca1aed39de10aafd401
Imphash
814ff5123980aa72132abc2d18aef873
Machine
AMD64
Version
v13.1
Publisher
New Horizon Datasys Inc
Download vulnerable sampleView on VirusTotal
shield-async.sysSample 2 · HVCI unknown
MD5
77e6a2b6883fb823d95d2d7659fedb1c
SHA1
fde65f0c98d0ca07144febb877d658f0287d2c12
SHA256
da3315363989b564a1b8b690bddfeb3bd81c1690a3da5813ca0c46a715fe94b0
Imphash
ac0b82ea403e2908815d3497b8178fe8
Machine
AMD64
Version
v13.1
Publisher
New Horizon Datasys Inc
Download vulnerable sampleView on VirusTotal
shieldwp.sysSample 3 · HVCI unknown
MD5
e2bfb13653b0569e4c3ddbde10f89493
SHA1
46ac52bc089575a393e6fc9adec6b63f63190e1c
SHA256
b1547490f3040b1e3668ee195adbf2d312024809915d01a71ed75fae72971a9d
Imphash
5a177e1c90aa9a1b811debb084c64f92
Machine
AMD64
Version
v13.1
Publisher
New Horizon Datasys Inc
Download vulnerable sampleView on VirusTotal

Recorded command

sc.exe create shield binPath=C:\windows\temp\shield.sys type=kernel && sc.exe start shield

Load vulnerable signed disk filter drivers for kernel memory access · Privileges: kernel · OS: Windows 10, Windows 11

Research & references

Acknowledgement: DellaNotto