Driver intelligenceVulnerableVerified

ImmunetUtilDriver.sys

ImmunetUtilDriver.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.

UUID / 79e1e3d4-36d0-4325-8d9c-c6e69b6084daADDED / 2026-04-17AUTHOR / Michael Haag

Known samples 1

1 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

ImmunetUtilDriver.sysSample 1 · HVCI TRUE

MD5: 413184d2547bba85b13b943df8200a81
SHA1: 1e3c0ca18950f8f0ad4f681753ae092d1916b4c1
SHA256: 2e270063af92a4f37d3f828dbb444c9a6277ea0d15a5b808e66e3b66ca5f5a58
Imphash: a16e9870c5694171719f826d2e37a9a3
Authentihash MD5: c5634574f950a349c1246ec2b568a047
Authentihash SHA1: f89809c387295cadfab5b0a4804fe4f33f5c8ac4
Authentihash SHA256: df809d2034204821509da0c870b5f34d4f98d5c7e4a35531d9742b40df853305
Machine: AMD64
Version: 0, 7, 9, 517
Publisher: Cisco Systems, Inc.

Download vulnerable sample View on VirusTotal

Recorded command

sc.exe create ImmunetUtilDriver binPath=C:\windows\temp\ImmunetUtilDriver.sys type=kernel && sc.exe start ImmunetUtilDriver

Elevate privileges · Privileges: kernel · OS: Windows 10

Research & references

Acknowledgement: @rainbowdynamix, @DbgPrint