b1f406cd-117a-45bb-97db-3f9ecb44f70d

sxav64-v1.5.1.sys :inline

Description

The signed SXClient sxav.sys security driver processes an SXBOOTDB boot configuration whose integrity is protected only by an unkeyed MD5 digest. Public research demonstrates that an administrator can generate a valid configuration containing arbitrary absolute paths, point the service to it, and have the kernel driver delete those files during the next boot. The primitive can be abused to remove security-product files that are otherwise locked while Windows is running.

  • UUID: b1f406cd-117a-45bb-97db-3f9ecb44f70d
  • Created: 2026-08-28
  • Author: Michael Haag
  • Acknowledgement: wwwab | @wwwab123

Download

This download link contains the vulnerable driver!

Block sxav64-v1.5.1.sys across your endpoints

Add this driver to your block policy in minutes with MagicSword, threat-driven application control. Free for up to 100 endpoints.

Start Blocking for Free

Commands

sc.exe create Sxav binPath= C:\windows\temp\sxav64-v1.5.1.sys type= kernel start= system
Use CasePrivilegesOperating System
Delete protected antivirus or EDR files during system boot using an attacker-generated boot configuration.kernelWindows 10, Windows 11

Detections

YARA 🏹

Expand

Exact Match

with header and size limitation

Threat Hunting

without header and size limitation

Renamed

for renamed driver files

Sigma 🛡️

Expand

Names

detects loading using name only

Hashes

detects loading using hashes only

Sysmon 🔎

Expand

Block

on hashes

Alert

on hashes

Resources


  • https://github.com/wwwab123/Sxav_ZwDeleteFile_BYOVD

    • CVE

    • Known Vulnerable Samples

    PropertyValue
    Filenamesxav64-v1.5.1.sys
    Creation Timestamp2026-06-30 02:45:56
    MD529a53ceac3376e0928a898779adb4c5a
    SHA177488e805d266aa1968842b4698565bb4fd8c36c
    SHA2564d47e7f1c87d758d9e3f17d0d53634c454ee1785478a8c7de7f3c83ecd3d3896
    Authentihash MD582a5166a8b7710ea462b6b6b686ec5d6
    Authentihash SHA16f5b769888b5989990478d34d16b120adf50e27c
    Authentihash SHA2569c246d9c611383dc1b32fda185322629aedc8527bd831ebfe41f5f92b1332070
    RichPEHeaderHash MD57d12388578802e8f1f5eb4af8c23f5d0
    RichPEHeaderHash SHA1ef8f667e744c231ffcd0efaa9d024451357e13ba
    RichPEHeaderHash SHA25636cd35cb00b81a2ebd9cb7d5d84c5dc0e06a30c0f0662d990fb3fb442ed95117
    Company河南寒露电子科技有限公司
    Description瞬犀安全防病毒软件
    Product瞬犀安全
    OriginalFilenamesxav.sys

    Download

    Certificates

    Expand
    Certificate 33000000849686aedfb4b66376000000000084
    FieldValue
    ToBeSigned (TBS) MD59fe699b3ab2f27e4f2aa6fcaca729d23
    ToBeSigned (TBS) SHA1be806effbdd84c713d2286ad1d79e5601c0a9b07
    ToBeSigned (TBS) SHA25604894d613d22d6af2d76b7f319073c187bee05eee27fd167a050076fb2009d45
    SubjectC=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher
    ValidFrom2026-05-13 18:17:34
    ValidTo2027-05-11 18:17:34
    Signature93cc2199d0389421a76807d521fdadd3ebc78db57beeabbfe80fef4ceca91861d30b11e74b6cc50b2d3082224b1c0d03c25153db795b52597215c29e7a85d8642fd16b1271d0c6766643583909ca9d6bc0f65ab21a3f82eb72a9f21ed72d229d960aa4b9995784837073fe28463c4d7ed553734eea8664c79f76d81dd2777d747d172182f62260b778ec9b0efacfbff430be868acff311f1f0700d547a3ccc37ecce1776332c3b679ac4c2e4ec2183144084886165856aff226ba6bff25b31757362be5a8687435c4c70e61d3fd33551a2315197238d76174943e4c2bfe2ac9198ee8116072aeb79a2f90f463d5e35f367c41604a2984d8e9da549c6f472be1aac6659574afa3cc12a5d4768faf08a945952b9b23dcff0e8d131c07366d18a95b04b12f454fb2dbea85f616e050e487c909a4d1cda95172dcc304306b699768375d0f3e1caf5f03db1975f6b7aa6e77588176027fb2d0b9b56b93249d19cca92528a4eedd85054f2b6f4f266f7b81b50510f4b58c3b2e733cb6999567fdf6b8c41e7667c899b4098b3b9cb18dde8e0a4a0a41aa83c27ca107f4440c6650ce21ea4ced7d43c72ab560240a0d0a2c68a24194c847eeaeb4c9b49bd5a69510b24c95c369604b0a3e241ef95389066b6cf139340d91b46b798615eb051d1adad8f9a2cad2cab64db5b9177ecc9aa0737c87f20084bd38e626195c13005cb185fb357
    SignatureAlgorithmOID1.2.840.113549.1.1.11
    IsCertificateAuthorityFalse
    SerialNumber33000000849686aedfb4b66376000000000084
    Version3
    Certificate 330000000d690d5d7893d076df00000000000d
    FieldValue
    ToBeSigned (TBS) MD583f69422963f11c3c340b81712eef319
    ToBeSigned (TBS) SHA10c5e5f24590b53bc291e28583acb78e5adc95601
    ToBeSigned (TBS) SHA256d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae
    SubjectC=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014
    ValidFrom2014-10-15 20:31:27
    ValidTo2029-10-15 20:41:27
    Signature96b5c33b31f27b6ba11f59dd742c3764b1bca093f9f33347e9f95df21d89f4579ee33f10a3595018053b142941b6a70e5b81a2ccbd8442c1c4bed184c2c4bd0c8c47bcbd8886fb5a0896ae2c2fdfbf9366a32b20ca848a6945273f732332936a23e9fffdd918edceffbd6b41738d579cf8b46d499805e6a335a9f07e6e86c06ba8086725afc0998cdba7064d4093188ba959e69914b912178144ac57c3ae8eae947bcb3b8edd7ab4715bba2bc3c7d085234b371277a54a2f7f1ab763b94459ed9230cce47c099212111f52f51e0291a4d7d7e58f8047ff189b7fd19c0671dcf376197790d52a0fbc6c12c4c50c2066f50e2f5093d8cafb7fe556ed09d8a753b1c72a6978dcf05fe74b20b6af63b5e1b15c804e9c7aa91d4df72846782106954d32dd6042e4b61ac4f24636de357302c1b5e55fb92b59457a9243d7c4e963dd368f76c728caa8441be8321a66cde5485c4a0a602b469206609698dcd933d721777f886dac4772daa2466eab64682bd24e98fb35cc7fec3f136d11e5db77edc1c37e1f6a4a14f8b4a721c671866770cdd819a35d1fa09b9a7cc55d4d728e74077fa74d00fcdd682412772a557527cda92c1d8e7c19ee692c9f7425338208db38cc7cc74f6c3a6bc237117872fe55596460333e2edfc42de72cd7fb0a82256fb8d70c84a5e1c4746e2a95329ea0fecdb4188fd33bad32b2b19ab86d0543fbff0d0f
    SignatureAlgorithmOID1.2.840.113549.1.1.11
    IsCertificateAuthorityTrue
    SerialNumber330000000d690d5d7893d076df00000000000d
    Version3

    Imports

    Expand
    • ntoskrnl.exe
    • HAL.dll
    • FLTMGR.SYS

    Imported Functions

    Expand
    • ZwFlushBuffersFile
    • ExAcquireFastMutex
    • ExReleaseFastMutex
    • MmUnlockPages
    • IofCompleteRequest
    • IoFreeMdl
    • ProbeForRead
    • __C_specific_handler
    • ZwSetInformationFile
    • RtlWriteRegistryValue
    • RtlCreateRegistryKey
    • ExGetPreviousMode
    • MmAllocateContiguousMemory
    • MmFreeContiguousMemory
    • IoBuildDeviceIoControlRequest
    • IofCallDriver
    • IoGetTopLevelIrp
    • IoAllocateWorkItem
    • IoFreeWorkItem
    • IoQueueWorkItem
    • ObfDereferenceObject
    • PsGetCurrentProcessId
    • IoVolumeDeviceToDosName
    • _vsnwprintf
    • MmMapLockedPagesSpecifyCache
    • IoCsqInsertIrp
    • IoCsqRemoveNextIrp
    • KeAreApcsDisabled
    • ZwDeleteFile
    • MmProbeAndLockPages
    • IoAllocateMdl
    • IoCreateDevice
    • IoCreateSymbolicLink
    • IoDeleteDevice
    • IoDeleteSymbolicLink
    • IoGetCurrentProcess
    • IoRegisterShutdownNotification
    • IoUnregisterShutdownNotification
    • IoCsqInitialize
    • ZwOpenFile
    • PsSetCreateProcessNotifyRoutineEx
    • KeStackAttachProcess
    • KeUnstackDetachProcess
    • PsLookupProcessByProcessId
    • IoQueryFileDosDeviceName
    • PsReferenceProcessFilePointer
    • InitSafeBootMode
    • RtlFreeUnicodeString
    • RtlStringFromGUID
    • ExUuidCreate
    • ZwDeviceIoControlFile
    • RtlInitializeGenericTable
    • RtlInsertElementGenericTable
    • RtlDeleteElementGenericTable
    • RtlLookupElementGenericTable
    • RtlEnumerateGenericTable
    • KeBugCheckEx
    • ZwReadFile
    • ZwWriteFile
    • ZwClose
    • ZwQueryInformationFile
    • ZwCreateFile
    • IoGetBootDiskInformation
    • RtlQueryRegistryValues
    • RtlInitUnicodeString
    • _wcsnicmp
    • _wcsicmp
    • ZwWaitForSingleObject
    • PsTerminateSystemThread
    • PsCreateSystemThread
    • ExDeleteResourceLite
    • ExReleaseResourceLite
    • ExAcquireResourceExclusiveLite
    • ExInitializeResourceLite
    • ExFreePoolWithTag
    • ExAllocatePoolWithTag
    • KeWaitForSingleObject
    • KeLeaveCriticalRegion
    • KeEnterCriticalRegion
    • KeDelayExecutionThread
    • KeSetEvent
    • KeInitializeEvent
    • ProbeForWrite
    • DbgPrintEx
    • KeQueryPerformanceCounter
    • FltFreeSecurityDescriptor
    • FltBuildDefaultSecurityDescriptor
    • FltSendMessage
    • FltCloseCommunicationPort
    • FltCreateCommunicationPort
    • FltGetDiskDeviceObject
    • FltReleaseContext
    • FltGetStreamContext
    • FltGetVolumeContext
    • FltDeleteStreamContext
    • FltSetStreamContext
    • FltSetVolumeContext
    • FltAllocateContext
    • FltReadFile
    • FltIsDirectory
    • FltGetDestinationFileNameInformation
    • FltParseFileNameInformation
    • FltReleaseFileNameInformation
    • FltGetFileNameInformation
    • FltStartFiltering
    • FltUnregisterFilter
    • FltRegisterFilter
    • FltSetCallbackDataDirty
    • FltGetRequestorProcessId

    Exported Functions

    Expand

    Sections

    Expand
    • .text
    • .rdata
    • .data
    • .pdata
    • INIT
    • .rsrc
    • .reloc

    Signature

    Expand
    {
  "Certificates": [
    {
      "CertificateType": "Leaf (Code Signing)",
      "IsCA": false,
      "IsCertificateAuthority": false,
      "IsCodeSigning": true,
      "SerialNumber": "33000000849686aedfb4b66376000000000084",
      "Signature": "93cc2199d0389421a76807d521fdadd3ebc78db57beeabbfe80fef4ceca91861d30b11e74b6cc50b2d3082224b1c0d03c25153db795b52597215c29e7a85d8642fd16b1271d0c6766643583909ca9d6bc0f65ab21a3f82eb72a9f21ed72d229d960aa4b9995784837073fe28463c4d7ed553734eea8664c79f76d81dd2777d747d172182f62260b778ec9b0efacfbff430be868acff311f1f0700d547a3ccc37ecce1776332c3b679ac4c2e4ec2183144084886165856aff226ba6bff25b31757362be5a8687435c4c70e61d3fd33551a2315197238d76174943e4c2bfe2ac9198ee8116072aeb79a2f90f463d5e35f367c41604a2984d8e9da549c6f472be1aac6659574afa3cc12a5d4768faf08a945952b9b23dcff0e8d131c07366d18a95b04b12f454fb2dbea85f616e050e487c909a4d1cda95172dcc304306b699768375d0f3e1caf5f03db1975f6b7aa6e77588176027fb2d0b9b56b93249d19cca92528a4eedd85054f2b6f4f266f7b81b50510f4b58c3b2e733cb6999567fdf6b8c41e7667c899b4098b3b9cb18dde8e0a4a0a41aa83c27ca107f4440c6650ce21ea4ced7d43c72ab560240a0d0a2c68a24194c847eeaeb4c9b49bd5a69510b24c95c369604b0a3e241ef95389066b6cf139340d91b46b798615eb051d1adad8f9a2cad2cab64db5b9177ecc9aa0737c87f20084bd38e626195c13005cb185fb357",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.11",
      "Subject": "C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher",
      "TBS": {
        "MD5": "9fe699b3ab2f27e4f2aa6fcaca729d23",
        "SHA1": "be806effbdd84c713d2286ad1d79e5601c0a9b07",
        "SHA256": "04894d613d22d6af2d76b7f319073c187bee05eee27fd167a050076fb2009d45",
        "SHA384": "fa1eb815b52f12434ab15fef34ae98bf077130fb31f022b93f999863606c7d1acc77ee05b6df2e7808487562bccbae8b"
      },
      "ValidFrom": "2026-05-13 18:17:34",
      "ValidTo": "2027-05-11 18:17:34",
      "Version": 3
    },
    {
      "CertificateType": "CA",
      "IsCA": true,
      "IsCertificateAuthority": true,
      "IsCodeSigning": false,
      "SerialNumber": "330000000d690d5d7893d076df00000000000d",
      "Signature": "96b5c33b31f27b6ba11f59dd742c3764b1bca093f9f33347e9f95df21d89f4579ee33f10a3595018053b142941b6a70e5b81a2ccbd8442c1c4bed184c2c4bd0c8c47bcbd8886fb5a0896ae2c2fdfbf9366a32b20ca848a6945273f732332936a23e9fffdd918edceffbd6b41738d579cf8b46d499805e6a335a9f07e6e86c06ba8086725afc0998cdba7064d4093188ba959e69914b912178144ac57c3ae8eae947bcb3b8edd7ab4715bba2bc3c7d085234b371277a54a2f7f1ab763b94459ed9230cce47c099212111f52f51e0291a4d7d7e58f8047ff189b7fd19c0671dcf376197790d52a0fbc6c12c4c50c2066f50e2f5093d8cafb7fe556ed09d8a753b1c72a6978dcf05fe74b20b6af63b5e1b15c804e9c7aa91d4df72846782106954d32dd6042e4b61ac4f24636de357302c1b5e55fb92b59457a9243d7c4e963dd368f76c728caa8441be8321a66cde5485c4a0a602b469206609698dcd933d721777f886dac4772daa2466eab64682bd24e98fb35cc7fec3f136d11e5db77edc1c37e1f6a4a14f8b4a721c671866770cdd819a35d1fa09b9a7cc55d4d728e74077fa74d00fcdd682412772a557527cda92c1d8e7c19ee692c9f7425338208db38cc7cc74f6c3a6bc237117872fe55596460333e2edfc42de72cd7fb0a82256fb8d70c84a5e1c4746e2a95329ea0fecdb4188fd33bad32b2b19ab86d0543fbff0d0f",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.11",
      "Subject": "C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014",
      "TBS": {
        "MD5": "83f69422963f11c3c340b81712eef319",
        "SHA1": "0c5e5f24590b53bc291e28583acb78e5adc95601",
        "SHA256": "d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae",
        "SHA384": "260ad59ba706420f68ba212931153bd89f760c464b21be55fba9d014fff322407859d4ebfb78ea9a3330f60dc9821a63"
      },
      "ValidFrom": "2014-10-15 20:31:27",
      "ValidTo": "2029-10-15 20:41:27",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014",
      "SerialNumber": "33000000849686aedfb4b66376000000000084",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

    source

    last_updated: 2026-08-31