← Back to driver explorer
Driver intelligenceVulnerableVerified
AccelLid.sys
AccelLid.sys is an Elitegroup Computer Systems lid accelerometer kernel driver. Northwave Cyber Security reported a local denial-of-service vulnerability with a CVSSv3 score of 5.5. The driver exposes IOCTL paths for accelerometer commands, keyboard control, event registration, and ACPI method execution. Microsoft's vulnerable driver blocklist denies AccelLid.sys across all file versions for matching Elitegroup publisher and signing roots.
Known samples 2
1 recorded TRUE · 0 recorded FALSE · 1 unknown for loading despite HVCI. Results apply to individual samples.
AccelLid.sysSample 1 · HVCI TRUE
- MD5
833becd0e4abc9cfff8c835694694f80- Machine
- Not recorded
- Version
- Not recorded
- Publisher
- Not recorded
AccelLid.sysSample 2 · HVCI unknown
- MD5
887e6502a420acb183342c60c396b0e3- SHA1
19871a15d483b9be1aa868a31a3384513b05e8ba- SHA256
08675796b8712e0e4ccbdf7831450b907bb94c2e3e85560d9aba1b24931f0d55- Imphash
082b83ad4226208cdab708a369872223- Authentihash MD5
937cafc2e6f943de27cbc971c063c4f6- Authentihash SHA1
eb4a5a669b4fd35839e28910b35b6f867df35258- Authentihash SHA256
4592f49005ff752a5a319ad49d11f110d417c3c60ea8d6705fd94945982ae8eb- Machine
- AMD64
- Version
- 1.0.0.1
- Publisher
- ECSl (E) Education
Recorded command
sc.exe create AccelLid.sys binPath=C:\windows\temp\AccelLid.sys type=kernel && sc.exe start AccelLid.sysTrigger vulnerable AccelLid.sys IOCTL handling for local denial of service. · Privileges: kernel · OS: Windows 10
Research & references
Acknowledgement: Northwave Cyber Security