← Back to driver explorer
Driver intelligenceVulnerableVerified
KslD.sys
KslD.sys is a Microsoft-signed Windows Defender support driver that can be abused for kernel memory access after its SharedState process-name check is redirected to an attacker-controlled process. Public research documents IOCTL 0x222044 as exposing physical and virtual memory read primitives that can support KASLR bypass, token discovery, and LSASS/PPL bypass workflows.
Known samples 1
0 recorded TRUE · 0 recorded FALSE · 1 unknown for loading despite HVCI. Results apply to individual samples.
KslD.sysSample 1 · HVCI unknown
- MD5
b316425d6f200244a25bd7b9998d9c43- SHA1
b678371d2dac5ad2fcca014ded25e0cc7a74eed1- SHA256
2b3195346d9b62b08bb61bb61f0da20b2abb0c726186c09a2e4fa926baacbfc5- Imphash
f202af7ca75a2191538cd0a107201e7a- Authentihash MD5
4e1f15c5d292c7fee5ce8d1e9b5b03e3- Authentihash SHA1
e0c981c2341a425f6fd21bcd469e038a4c5da5f9- Authentihash SHA256
5bfc550dcbf7ea19663a3e1db089aa247c372372d00b09e60e047b401df1daf2- Machine
- AMD64
- Version
- 1.1.25041.64017 (5f4e0875c06cb7d3b67e5e7e4354b254dda9b0b4)
- Publisher
- Microsoft Corporation
Recorded command
reg add "HKLM\SYSTEM\CurrentControlSet\Services\KslD\SharedState" /v AllowedProcessName /t REG_SZ /d "\Device\HarddiskVolumeX\Path\To\Exploit.exe" /f && sc.exe start KslDAbuse a trusted Microsoft Defender support driver for kernel memory reads and credential-dumping support primitives. · Privileges: kernel · OS: Windows 10, Windows 11
Research & references
Acknowledgement: Noam Pomerantz Pumi96