← Back to driver explorer
Driver intelligenceVulnerableVerified
btfilter.sys
A vulnerable kernel driver that can be used to disable Code Integrity
Known samples 2
0 recorded TRUE · 0 recorded FALSE · 2 unknown for loading despite HVCI. Results apply to individual samples.
btfilter.sysSample 1 · HVCI unknown
- MD5
b655e2e9a50e1db45ea492ae1025390f- SHA1
086487217cba196f523f75958cba86fc5635dd89- SHA256
415bfdd549ce7f0b0011fe45c7330e0c44935f1bbdcedd64246a9fdfb921196f- Imphash
f3dc67d28043552615e5c3e1c5ee2777- Authentihash MD5
4da06c14aaf93398822a7af4dd617738- Authentihash SHA1
681a49470babca795fda69d002817936201ab220- Authentihash SHA256
c8dc0947e07b5c52c194fe018f568dc31b7dbba7d06f241b22c857fcbe4cf81f- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
btfilter.sysSample 2 · HVCI unknown
- MD5
52043b775e018d1d0c256cf955841565- SHA1
3a91e221bbaa5045b517564c311904bd264b248f- SHA256
8544781f315c3bbba896e11a0746a6ed1eeb618e6c39a9b7f2fbde0f24b02200- Imphash
2a5367d97f5ac684ba43dd7dc1b9e109- Authentihash MD5
c0cb9a0af5a6612070966b955696e8ff- Authentihash SHA1
78d8c253c2186d892bab1556a44b23d052930b22- Authentihash SHA256
a32a1b0d99f45e8433c05c1fb0413196b73d6ae15e5a082c580781efef98edfc- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
Recorded command
sc.exe create btfilter binPath=C:\windows\temp\btfilter.sys type=kernel && sc.exe start btfilterElevate privileges · Privileges: kernel · OS: Windows 10
Research & references
Acknowledgement: Andrea Monzani, Davide Netti, Antonio Parata