← Back to driver explorer
Driver intelligenceMaliciousVerified
tdevflt.sys
This ABYSSWORKER-related malicious kernel driver presents as Palo Alto Networks tdevflt.sys / Cortex XDR PnP Device Filter Driver. Public DragonForce reporting lists the sample in a BYOVD tradecraft set alongside known vulnerable process-killer drivers.
Known samples 1
0 recorded TRUE · 0 recorded FALSE · 1 unknown for loading despite HVCI. Results apply to individual samples.
tdevflt.sysSample 1 · HVCI unknown
- MD5
0aaae94aeed94870f755487e8ec17259- SHA1
a86c445b9d233b6316a66842c5224265feda8ba7- SHA256
8284c8676cc22c4b2e66826ac16986da7ddecba1f2776b16771be17bfdc45dc2- Imphash
4e3c3df003b6a014459f47ae8cb021c7- Authentihash MD5
50e90bfdf8fa6faf9053edaf307feb9e- Authentihash SHA1
31137aa5b90d11eb8f3f1b043af4d24ed22ccd37- Authentihash SHA256
fd69888d8a21fe3a7a4a7b099734fe254e8bf8f6d77c5b7b28788138b6c6a396- Machine
- AMD64
- Version
- 8.2.2.49708
- Publisher
- Palo Alto Networks, Inc.
Recorded command
sc.exe create tdevflt binPath=C:\windows\temp\tdevflt.sys type=kernel && sc.exe start tdevfltMalicious kernel driver used with BYOVD-style defense evasion tradecraft. · Privileges: kernel · OS: Windows 10, Windows 11
Research & references
Acknowledgement: Symantec Threat Hunter Team