LOLDriversTHE DRIVER THREAT CATALOG
← Back to driver explorer
Driver intelligenceVulnerableVerified

unknown.sys

unknown.sys is an unattributed signed kernel driver documented in public UnknownKiller / BlackSnufkin BYOVD research. The public PoCs identify the driver as exposing a process-kill primitive suitable for BYOVD process termination research.

UUID / bffcac17-f20c-43cc-baf0-93fd20bc1ed5ADDED / 2026-06-16AUTHOR / Michael Haag

Known samples 1

0 recorded TRUE · 0 recorded FALSE · 1 unknown for loading despite HVCI. Results apply to individual samples.

unknown.sysSample 1 · HVCI unknown
MD5
4e5136230ec590ce6ef038aac6e72cb2
SHA1
ba914fe77b177b45799403b16dd14765c510a074
SHA256
97bd65e98cdc4e93d49edd4ea905d43a61244df0fd3323e6649330de3b1be091
Imphash
176b3852ff8a4c513156b0ded5c86113
Authentihash MD5
793ea731f474590d5542d0df0f1db133
Authentihash SHA1
ed88d7f2d05454545272e80a8c6450783a4e6083
Authentihash SHA256
0d7099bd4a0714a354cfe36f312d907843bcaaa2a1e3dcf269637f58920b1e47
Machine
AMD64
Version
Not recorded
Publisher
Not recorded
Download vulnerable sampleView on VirusTotal

Recorded command

sc.exe create unknown binPath=C:\windows\temp\unknown.sys type=kernel && sc.exe start unknown

Terminate processes from kernel mode through an unattributed vulnerable driver. · Privileges: kernel · OS: Windows 10, Windows 11

Research & references

Acknowledgement: BlackSnufkin / lukmannurhikma @BlackSnufkin42 / @lukmannurhikma