Driver intelligenceVulnerableVerified

watabe.sys

watabe.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.

UUID / 549d3563-74ce-4d84-844c-8d985886373cADDED / 2026-04-17AUTHOR / Michael Haag

Known samples 1

1 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

watabe.sysSample 1 · HVCI TRUE

MD5: 3d47b72711f29447c0105e6617e849d9
SHA1: aa40f06968b60a9cca272ae604f469610b767a71
SHA256: 42bbad0caff790db44833fc67a202850576d73d278ea85fb8095e3f93b0b4370
Imphash: 19893acf1f4d216b6908eeb539a25e18
Authentihash MD5: 1f694d5b026c4cdded1fe42bd63041ea
Authentihash SHA1: a454e02cb3c10b441313bc2f896bbfd072a1610e
Authentihash SHA256: 53e17fa767d63cbc20f34726865de99a511e70d10def3b68e606969d71ab4fe0
Machine: AMD64
Version: Not recorded
Publisher: Not recorded

Download vulnerable sample View on VirusTotal

Recorded command

sc.exe create watabe binPath=C:\windows\temp\watabe.sys type=kernel && sc.exe start watabe

Elevate privileges · Privileges: kernel · OS: Windows 10

Research & references

Acknowledgement: @rainbowdynamix, @DbgPrint