Driver intelligenceVulnerableVerified

SIOCTL.sys

SIOCTL.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.

UUID / 47e08b2f-7925-40c5-9bcf-0af348c07d33ADDED / 2026-04-17AUTHOR / Michael Haag

Known samples 1

0 recorded TRUE · 1 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

SIOCTL.sysSample 1 · HVCI FALSE

MD5: 6ffd62ce4d143451a9ad3bb2af374b55
SHA1: 5082d66a2c8a57e1a37dc6a026d9b73b12d63d97
SHA256: 3a24b63cce5a4b7bd6188940af75b05a414b283c3c8eb528b5ba607ef720fc93
Imphash: dd93739efba0ca056d3f3afa731780d2
Authentihash MD5: 1a614e1cc9eafc71e98eaeed634b78ea
Authentihash SHA1: 3d462abc0af9cceca9b2099b5faea3845a32bf5c
Authentihash SHA256: 2cb14666f3cf80eff612fdc33d50c150e2771a584ce5056ac5cf06f44ccb4ab6
Machine: AMD64
Version: 10.0.10011.16384
Publisher: Windows (R) Win 7 DDK provider

Download vulnerable sample View on VirusTotal

Recorded command

sc.exe create SIOCTL binPath=C:\windows\temp\SIOCTL.sys type=kernel && sc.exe start SIOCTL

Elevate privileges · Privileges: kernel · OS: Windows 10

Research & references

Acknowledgement: @rainbowdynamix, @DbgPrint