Driver intelligenceVulnerableVerified

sdrv_win_sliff.sys

sdrv_win_sliff.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.

UUID / f1dd9c41-2608-48e5-bb3e-191d56b34591ADDED / 2026-04-17AUTHOR / Michael Haag

Known samples 1

1 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

sdrv_win_sliff.sysSample 1 · HVCI TRUE

MD5: 67da2461cf1299dcc6a42f531f370024
SHA1: 2b0fbb21bdf90035c853ae7bb67f794cd1d4d947
SHA256: 3e3a6014ae76b9ae43af033c28e17d8d1c2965d59f2fea909b251b14966e92d2
Imphash: 94d242be4d4389977ccc49eb1cf5d49d
Authentihash MD5: 8efe7d6387b9dd8d0c17ffcc75ccddab
Authentihash SHA1: 699a079a8d368822eec73ee7b4c1b347ac0a78f1
Authentihash SHA256: 370844987d3467940e9d99f098935b7ff921e734b8b6ac194ce4d7a16da8f75f
Machine: AMD64
Version: Not recorded
Publisher: Not recorded

Download vulnerable sample View on VirusTotal

Recorded command

sc.exe create sdrv_win_sliff binPath=C:\windows\temp\sdrv_win_sliff.sys type=kernel && sc.exe start sdrv_win_sliff

Elevate privileges · Privileges: kernel · OS: Windows 10

Research & references

Acknowledgement: @rainbowdynamix, @DbgPrint