Description AccelLid.sys is an Elitegroup Computer Systems lid accelerometer kernel driver. Northwave Cyber Security reported a local denial-of-service vulnerability with a CVSSv3 score of 5.5. The driver exposes IOCTL paths for accelerometer commands, keyboard control, event registration, and ACPI method execution. Microsoft's vulnerable driver blocklist denies AccelLid.sys across all file versions for matching Elitegroup publisher and signing roots.
UUID : d9e9fab2-6b64-4c14-b1ec-7af1923c0773Created : 2024-09-11Author : Northwave Cyber SecurityAcknowledgement : Northwave Cyber Security | Download
This download link contains the vulnerable driver!
Block AccelLid.sys across your endpoints Add this driver to your block policy in minutes with MagicSword, threat-driven application control. Free for up to 100 endpoints.
Start Blocking for Free Commands sc.exe create AccelLid.sys binPath=C:\windows\temp\AccelLid.sys type=kernel && sc.exe start AccelLid.sys
Use Case Privileges Operating System Trigger vulnerable AccelLid.sys IOCTL handling for local denial of service. kernel Windows 10
Detections Sigma 🛡️ Expand Names
detects loading using name only
Hashes
detects loading using hashes only
Resources https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/microsoft-recommended-driver-block-rules https://github.com/magicsword-io/LOLDrivers/issues/355 Known Vulnerable Samples Download
Imports Expand Imported Functions Expand Exported Functions Expand Sections Expand Signature Expand Download
Certificates Expand Certificate 7e93ebfb7cc64e59ea4b9a77d406fc3b Field Value ToBeSigned (TBS) MD5 d0785ad36e427c92b19f6826ab1e8020 ToBeSigned (TBS) SHA1 365b7a9c21bd9373e49052c3e7b3e4646ddd4d43 ToBeSigned (TBS) SHA256 c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff Subject C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2 ValidFrom 2012-12-21 00:00:00 ValidTo 2020-12-30 23:59:59 Signature 03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6 SignatureAlgorithmOID 1.2.840.113549.1.1.5 IsCertificateAuthority True SerialNumber 7e93ebfb7cc64e59ea4b9a77d406fc3b Version 3
Certificate 0ecff438c8febf356e04d86a981b1a50 Field Value ToBeSigned (TBS) MD5 e9d38360b914c8863f6cba3ee58764d3 ToBeSigned (TBS) SHA1 4cba8eae47b6bf76f20b3504b98b8f062694a89b ToBeSigned (TBS) SHA256 88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976 Subject C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4 ValidFrom 2012-10-18 00:00:00 ValidTo 2020-12-29 23:59:59 Signature 783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475 SignatureAlgorithmOID 1.2.840.113549.1.1.5 IsCertificateAuthority False SerialNumber 0ecff438c8febf356e04d86a981b1a50 Version 3
Certificate 485f40b07aa4819096a44a73dcfa34b0 Field Value ToBeSigned (TBS) MD5 ab020c9b05cc99889cabdee78fde0729 ToBeSigned (TBS) SHA1 c89a4ecbd0c7cf1e7e0f76d6b6267da44137285b ToBeSigned (TBS) SHA256 49e67f0d473043822141e2a942adba90b351a38aff0df5924447ffee8bfbdc0f Subject C=TW, ST=Taiwan, L=Taipei, O=Elitegroup Computer Systems Co Ltd, CN=Elitegroup Computer Systems Co Ltd ValidFrom 2015-08-18 00:00:00 ValidTo 2018-07-06 23:59:59 Signature 8523dbbc4988df62513a65168c2248adada26552d90ff02ef0e6a376f1ccca5e82dceaa958144fb85d46b04804502f33e28cda7688c77b1a104f7ef34aa15028a16d57527461d0a2abcb54217b42cb8e700569811386ec3a282048ae72656fe63c8468843a69b9497c5a72381bf3080abe785575588e88d3ecb96c9bec09ff77e4bac299eccd9fb60714b9ae6ba13f9270dee83953f346dadb56767412677ee180614343708a50c3da3b46c89ce7b860bb8a71ab593e491a53e1b8d0e4ff0c119307e8d0b338531d7ccfadba36ca1b80c907edf2b377b81e2224561f5b729a481573c3301d5dee5a6cea3cc6d76153b7b6041aa6622cdda4822a7d37ec9acfb7 SignatureAlgorithmOID 1.2.840.113549.1.1.11 IsCertificateAuthority False SerialNumber 485f40b07aa4819096a44a73dcfa34b0 Version 3
Certificate 3d78d7f9764960b2617df4f01eca862a Field Value ToBeSigned (TBS) MD5 1f056ff7d5f874984dc605402b7cb042 ToBeSigned (TBS) SHA1 bdb348353a2203deb4b767914fa1bd7248dd728b ToBeSigned (TBS) SHA256 a08e79c386083d875014c409c13d144e0a24386132980df11ff59737c8489eb1 Subject C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 SHA256 Code Signing CA ValidFrom 2013-12-10 00:00:00 ValidTo 2023-12-09 23:59:59 Signature 13851a1e69a937f7a0bda4af7e1d6153fe9d8c5e0ca6751e781723ddfdec1a035539fb7195c7655aa78e30d2445a61db706fda2105c22e73ba49f1d193fe5dc9cd5e03e0899e3f741ed7f7388ba9d6cfbb352f3358a89256d1c84d3b82e6798416fc28b0b147f31da23eee87d9a67fa456a53fad842e29de7cbca8aaa33d0401eaba93a20e502229174c87e43a115fd6a425899b056b2fb4c9014c277b0bac190522a060153fdac9fb4d4c8ffb726777fd2794c7ba350e8849fe8dfd28af4a12bd0db39705de440c15fa362b03dcc15001f1a1115d14e5e2bd274b54be2b845e0fa6c374050aef97c38922b11f77f3bdcd43d4f14ca93fb58b84af64f2d01421 SignatureAlgorithmOID 1.2.840.113549.1.1.11 IsCertificateAuthority True SerialNumber 3d78d7f9764960b2617df4f01eca862a Version 3
Certificate 611993e400000000001c Field Value ToBeSigned (TBS) MD5 78a717e082dcc1cda3458d917e677d14 ToBeSigned (TBS) SHA1 4a872e0e51f9b304469cd1dedb496ee9b8b983a4 ToBeSigned (TBS) SHA256 317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8 Subject C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5 ValidFrom 2011-02-22 19:25:17 ValidTo 2021-02-22 19:35:17 Signature 812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94 SignatureAlgorithmOID 1.2.840.113549.1.1.5 IsCertificateAuthority True SerialNumber 611993e400000000001c Version 3
Imports Expand Imported Functions Expand RtlInitUnicodeString RtlFreeUnicodeString DbgPrint KeInitializeEvent KeSetEvent KeInitializeMutex KeReleaseMutex KeWaitForSingleObject ExAllocatePoolWithTag ExFreePoolWithTag ExAcquireFastMutex ExReleaseFastMutex IoAttachDeviceToDeviceStack IofCallDriver IofCompleteRequest IoDeleteDevice IoDetachDevice IoInitializeRemoveLockEx IoAcquireRemoveLockEx IoReleaseRemoveLockEx IoReleaseRemoveLockAndWaitEx IoRegisterDeviceInterface IoSetDeviceInterfaceState IoSetDeviceInterfacePropertyData PoCallDriver PoStartNextPowerIrp memcpy_s KeLowerIrql KfRaiseIrql KeAcquireSpinLockRaiseToDpc KeReleaseSpinLock KeAcquireGuardedMutex KeReleaseGuardedMutex IoAllocateIrp IoBuildDeviceIoControlRequest IoFreeIrp IoIs32bitProcess ObReferenceObjectByHandle ObfDereferenceObject IoGetLowerDeviceObject ExEventObjectType MmGetSystemRoutineAddress ZwClose ZwSetSecurityObject IoDeviceObjectType IoCreateDevice ObOpenObjectByPointer RtlGetDaclSecurityDescriptor RtlGetGroupSecurityDescriptor RtlGetOwnerSecurityDescriptor RtlGetSaclSecurityDescriptor SeCaptureSecurityDescriptor _snwprintf RtlLengthSecurityDescriptor SeExports RtlCreateSecurityDescriptor _wcsnicmp wcschr RtlAbsoluteToSelfRelativeSD RtlAddAccessAllowedAce RtlLengthSid IoIsWdmVersionAvailable RtlSetDaclSecurityDescriptor ZwOpenKey ZwSetValueKey ZwQueryValueKey ZwCreateKey Exported Functions Expand Sections Expand .text .rdata .data .pdata .gfids PAGE INIT .rsrc .reloc Signature Expand source
last_updated: 2026-07-10
