Driver intelligenceVulnerableVerified

RCFlCtrl.sys

RCFlCtrl.sys, labeled as "RedCastle Control Driver", is a vulnerable kernel driver that can be used to terminate arbitrary processes via IOCTL 0x85000158

UUID / a7d2a088-b00b-4f5c-96ca-7a98070dddd5ADDED / 2026-10-25AUTHOR / Andrea Monzani

Known samples 1

0 recorded TRUE · 0 recorded FALSE · 1 unknown for loading despite HVCI. Results apply to individual samples.

RCFlCtrl.sysSample 1 · HVCI unknown

MD5: e53dd75097a7afbb9bdf68713d47df01
SHA1: 8f0cb2d25448e326f4dcdb0d452b968938383d49
SHA256: 04bdcd0c70fb07e1c551be3078cf0e82cf53dd4dba3752b74e5db4a715933d16
Imphash: e6952bf01526fcb4c51de27a2dd72f93
Authentihash MD5: 21bcb4976b54a45dda39a23df45fa4e8
Authentihash SHA1: 8350ef2c3d6e4a89674b70fd77735015156e1318
Authentihash SHA256: 7a91bee028b7db8d24a406115c973a3d05e8403d8dda50293a802f5e7610ae97
Machine: AMD64
Version: Not recorded
Publisher: Not recorded

Download vulnerable sample View on VirusTotal

Recorded command

sc.exe create RCFlCtrl binPath=C:\windows\temp\RCFlCtrl.sys type=kernel && sc.exe start RCFlCtrl

Elevate privileges · Privileges: kernel · OS: Windows 10

Research & references

https://doi.org/10.1016/j.cose.2026.105194

Acknowledgement: Andrea Monzani, Davide Netti, Antonio Parata