Driver intelligenceVulnerableVerified

IUForceDelete.sys

IUForceDelete.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.

UUID / b898cc81-1736-45c7-ab41-c104ab17f05dADDED / 2026-04-17AUTHOR / Michael Haag

Known samples 1

1 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

IUForceDelete.sysSample 1 · HVCI TRUE

MD5: 354454ae9d36c3fb06c8a0e2addcac74
SHA1: ad24e1429291967d356afc0324e3393a092e9aad
SHA256: 30f5d03e37d22c7dece8bb8240edc8566f2be7fe76d3c7f97eeceb60d889ee06
Imphash: 9b63a4ea8650c15909e5d7dd1c3ed64c
Authentihash MD5: 18d857b5810642803e05cb8c7769fb1b
Authentihash SHA1: 81d8dd3616e6cc359fa8f1db6f59bd02a9e19900
Authentihash SHA256: 48b6eb343e4e6e3a4b551e589ae7dd2bc07a5488e938398ee90eaa9041b1644c
Machine: AMD64
Version: 1.0 built by: WinDDK
Publisher: IObit

Download vulnerable sample View on VirusTotal

Recorded command

sc.exe create IUForceDelete binPath=C:\windows\temp\IUForceDelete.sys type=kernel && sc.exe start IUForceDelete

Elevate privileges · Privileges: kernel · OS: Windows 10

Research & references

Acknowledgement: @rainbowdynamix, @DbgPrint