LOLDriversTHE DRIVER THREAT CATALOG
← Back to driver explorer
Driver intelligenceVulnerableVerified

PoisonX.sys

A Microsoft-signed vulnerable driver used in BYOVD attacks to terminate protected processes, including EDR solutions such as CrowdStrike Falcon. The driver exposes an IOCTL that allows arbitrary process termination from user mode by passing a PID.

UUID / fc3467c3-6109-447d-b438-7a4276c3d8e5ADDED / 2026-04-10AUTHOR / Bilal Retiat

Known samples 19

0 recorded TRUE · 18 recorded FALSE · 1 unknown for loading despite HVCI. Results apply to individual samples.

PoisonX.sysSample 1 · HVCI FALSE
MD5
2cc835399634d1f8f50e465201bfd877
SHA1
4cad3e674682d3d70cc875977f23d71f41ceb55e
SHA256
a5035cbd6c31616288aa66d98e5a25441ee38651fb5f330676319f921bb816a4
Imphash
47c3554d0dee53d4f925ed52484bea12
Authentihash MD5
db166d299a9aa3671c9260869cecbe40
Authentihash SHA1
d47243560273ada0b12276a0592a4a5682148fc4
Authentihash SHA256
1ce001eda18c7a0636c4053848a1ae69812704795ab057331903d7002d688027
Machine
AMD64
Version
Not recorded
Publisher
Not recorded
Download vulnerable sampleView on VirusTotal
G11.sysSample 2 · HVCI unknown
MD5
07e9f0b8627a95960e79e930fb099e84
SHA1
56bee9df5833a637f5c54d5911df98b0812fe643
SHA256
2d91a78e739891c9854c254f5b2a6b84c0e167dfa253466cbccd2cdd1c20145d
Imphash
47c3554d0dee53d4f925ed52484bea12
Authentihash MD5
db166d299a9aa3671c9260869cecbe40
Authentihash SHA1
d47243560273ada0b12276a0592a4a5682148fc4
Authentihash SHA256
1ce001eda18c7a0636c4053848a1ae69812704795ab057331903d7002d688027
Machine
AMD64
Version
Not recorded
Publisher
Not recorded
Download vulnerable sampleView on VirusTotal
PoisonX10.sysSample 3 · HVCI FALSE
MD5
e4704b728eb6daeeb780688786303c4f
SHA1
a3bfa49170fa5808d66415ba73f5aac68a195ffd
SHA256
d58df93524ead1a1f939438ef63b5a9e42aacec7463ed29878293382996640ce
Imphash
47c3554d0dee53d4f925ed52484bea12
Authentihash MD5
db166d299a9aa3671c9260869cecbe40
Authentihash SHA1
d47243560273ada0b12276a0592a4a5682148fc4
Authentihash SHA256
1ce001eda18c7a0636c4053848a1ae69812704795ab057331903d7002d688027
Machine
AMD64
Version
Not recorded
Publisher
Not recorded
Download vulnerable sampleView on VirusTotal
PoisonX11.sysSample 4 · HVCI FALSE
MD5
f1284aeb27c65ee78c05e57445d1fa41
SHA1
d7532ac30664c3fe6fef0d769dedf0d6ee52e9f9
SHA256
cc6b4e34a4c49ce2770615aa38b00ce479e236d34307f950cf5d8ad46b458627
Imphash
47c3554d0dee53d4f925ed52484bea12
Authentihash MD5
db166d299a9aa3671c9260869cecbe40
Authentihash SHA1
d47243560273ada0b12276a0592a4a5682148fc4
Authentihash SHA256
1ce001eda18c7a0636c4053848a1ae69812704795ab057331903d7002d688027
Machine
AMD64
Version
Not recorded
Publisher
Not recorded
Download vulnerable sampleView on VirusTotal
PoisonX12.sysSample 5 · HVCI FALSE
MD5
61c06b9796fa249cb83217cbe776fab5
SHA1
b6031d299769433388f1998a13ba83743d88c247
SHA256
c070b4a5614cb234de0faaef4e131b0cfe127682dc4cc89856e1ebfe775f4725
Imphash
47c3554d0dee53d4f925ed52484bea12
Authentihash MD5
db166d299a9aa3671c9260869cecbe40
Authentihash SHA1
d47243560273ada0b12276a0592a4a5682148fc4
Authentihash SHA256
1ce001eda18c7a0636c4053848a1ae69812704795ab057331903d7002d688027
Machine
AMD64
Version
Not recorded
Publisher
Not recorded
Download vulnerable sampleView on VirusTotal
PoisonX13.sysSample 6 · HVCI FALSE
MD5
1a5820c57cbb62031ae62aa89c13e9e0
SHA1
a8e12c5c08367c673ac217739061809640da579c
SHA256
50870b82104a309c107ad6ed50c023324fd73b6908a52f6070f47b8d247323c9
Imphash
47c3554d0dee53d4f925ed52484bea12
Authentihash MD5
db166d299a9aa3671c9260869cecbe40
Authentihash SHA1
d47243560273ada0b12276a0592a4a5682148fc4
Authentihash SHA256
1ce001eda18c7a0636c4053848a1ae69812704795ab057331903d7002d688027
Machine
AMD64
Version
Not recorded
Publisher
Not recorded
Download vulnerable sampleView on VirusTotal
PoisonX14.sysSample 7 · HVCI FALSE
MD5
ab62fdf30dcea2ee9b82fd50cdd6a2e5
SHA1
07f3dd893430d818fb55b7e5f3164c62c701db96
SHA256
6452ca681dd818a36ec538fe2d83a795f98e14970855964520294726dedd742b
Imphash
47c3554d0dee53d4f925ed52484bea12
Authentihash MD5
db166d299a9aa3671c9260869cecbe40
Authentihash SHA1
d47243560273ada0b12276a0592a4a5682148fc4
Authentihash SHA256
1ce001eda18c7a0636c4053848a1ae69812704795ab057331903d7002d688027
Machine
AMD64
Version
Not recorded
Publisher
Not recorded
Download vulnerable sampleView on VirusTotal
PoisonX15.sysSample 8 · HVCI FALSE
MD5
cbf2368a99800ef253c66082dbf3d05b
SHA1
4ff837a263648aa15dba8ed1f8e8056b2f18b26b
SHA256
846b2f282925d7ddccd41f46f0048bc1f424fe44ccb110ed45ece8637fbece5d
Imphash
47c3554d0dee53d4f925ed52484bea12
Authentihash MD5
db166d299a9aa3671c9260869cecbe40
Authentihash SHA1
d47243560273ada0b12276a0592a4a5682148fc4
Authentihash SHA256
1ce001eda18c7a0636c4053848a1ae69812704795ab057331903d7002d688027
Machine
AMD64
Version
Not recorded
Publisher
Not recorded
Download vulnerable sampleView on VirusTotal
PoisonX16.sysSample 9 · HVCI FALSE
MD5
9ead2939aa5b9464f61c81010c719ea0
SHA1
799131660eddf8bbe88eb2266bd40c3a7f870708
SHA256
103b1bbe9d257e3ae6b83befdc53cad0e5432ade535b1f85dd6fddd4356d4898
Imphash
47c3554d0dee53d4f925ed52484bea12
Authentihash MD5
db166d299a9aa3671c9260869cecbe40
Authentihash SHA1
d47243560273ada0b12276a0592a4a5682148fc4
Authentihash SHA256
1ce001eda18c7a0636c4053848a1ae69812704795ab057331903d7002d688027
Machine
AMD64
Version
Not recorded
Publisher
Not recorded
Download vulnerable sampleView on VirusTotal
PoisonX17.sysSample 10 · HVCI FALSE
MD5
329d497d5f043386395c37f12278bf37
SHA1
e6608fa064f2fe68537b484279588e97afe2888b
SHA256
6f24ed64cba4ed0901592770a3aead821317a85efa886bd51f1afc6cb1166990
Imphash
47c3554d0dee53d4f925ed52484bea12
Authentihash MD5
db166d299a9aa3671c9260869cecbe40
Authentihash SHA1
d47243560273ada0b12276a0592a4a5682148fc4
Authentihash SHA256
1ce001eda18c7a0636c4053848a1ae69812704795ab057331903d7002d688027
Machine
AMD64
Version
Not recorded
Publisher
Not recorded
Download vulnerable sampleView on VirusTotal
PoisonX18.sysSample 11 · HVCI FALSE
MD5
c7c85a843138d250e29abc52ef5f09cd
SHA1
cd11016bd285e142600adbee465307645bead350
SHA256
1d9ae1467e604469798d272755afcf845b5efcd588863ad9e2aa3e3cf112985a
Imphash
47c3554d0dee53d4f925ed52484bea12
Authentihash MD5
db166d299a9aa3671c9260869cecbe40
Authentihash SHA1
d47243560273ada0b12276a0592a4a5682148fc4
Authentihash SHA256
1ce001eda18c7a0636c4053848a1ae69812704795ab057331903d7002d688027
Machine
AMD64
Version
Not recorded
Publisher
Not recorded
Download vulnerable sampleView on VirusTotal
PoisonX2.sysSample 12 · HVCI FALSE
MD5
5cceaa1cec420174ec9ec5d63c4ccfc6
SHA1
60d2ba7a6927a2e159d7e65d6fbfab78756c725e
SHA256
b1ec23cf04e9ea0672f18486601e798c882b0b981772f6bca5c144d2f2af9889
Imphash
47c3554d0dee53d4f925ed52484bea12
Authentihash MD5
db166d299a9aa3671c9260869cecbe40
Authentihash SHA1
d47243560273ada0b12276a0592a4a5682148fc4
Authentihash SHA256
1ce001eda18c7a0636c4053848a1ae69812704795ab057331903d7002d688027
Machine
AMD64
Version
Not recorded
Publisher
Not recorded
Download vulnerable sampleView on VirusTotal
PoisonX3.sysSample 13 · HVCI FALSE
MD5
560989542e657f995ef0560ef7bba355
SHA1
18ef5dae58ad74584d5ffb89150f7aa47784bc65
SHA256
4948e89b532804590490aaae41f4b582a89592c931e557b6ddfff0b8d6ee8cf5
Imphash
47c3554d0dee53d4f925ed52484bea12
Authentihash MD5
db166d299a9aa3671c9260869cecbe40
Authentihash SHA1
d47243560273ada0b12276a0592a4a5682148fc4
Authentihash SHA256
1ce001eda18c7a0636c4053848a1ae69812704795ab057331903d7002d688027
Machine
AMD64
Version
Not recorded
Publisher
Not recorded
Download vulnerable sampleView on VirusTotal
PoisonX4.sysSample 14 · HVCI FALSE
MD5
3c8b012b840b03ae3cff564e35122dcf
SHA1
d8ef024f5634552041a26d9a2fb3c0205c2cd023
SHA256
83db6a37d9ec9923ca2aa677b4f4d8b67c8b2468046d21136a57ffe92eba6cac
Imphash
47c3554d0dee53d4f925ed52484bea12
Authentihash MD5
db166d299a9aa3671c9260869cecbe40
Authentihash SHA1
d47243560273ada0b12276a0592a4a5682148fc4
Authentihash SHA256
1ce001eda18c7a0636c4053848a1ae69812704795ab057331903d7002d688027
Machine
AMD64
Version
Not recorded
Publisher
Not recorded
Download vulnerable sampleView on VirusTotal
PoisonX5.sysSample 15 · HVCI FALSE
MD5
beb50004be24e5b536c1eb8123568fcc
SHA1
03b9ff1837a1887e505ffe837f8323962e67cf6e
SHA256
63eaa6be7c2f220af0f5fdf3b232f18908777262ecc0919796a92438aec74b89
Imphash
47c3554d0dee53d4f925ed52484bea12
Authentihash MD5
db166d299a9aa3671c9260869cecbe40
Authentihash SHA1
d47243560273ada0b12276a0592a4a5682148fc4
Authentihash SHA256
1ce001eda18c7a0636c4053848a1ae69812704795ab057331903d7002d688027
Machine
AMD64
Version
Not recorded
Publisher
Not recorded
Download vulnerable sampleView on VirusTotal
PoisonX6.sysSample 16 · HVCI FALSE
MD5
1bfb3817e672bad6597fe19c6ad60198
SHA1
6e9fc6aff2d72822d7ac93a41dc9305bc5a9f3d8
SHA256
40a46b17a8ccb3104b079716d764ceeda1f8431cb6582308f59af5802fe82fda
Imphash
47c3554d0dee53d4f925ed52484bea12
Authentihash MD5
db166d299a9aa3671c9260869cecbe40
Authentihash SHA1
d47243560273ada0b12276a0592a4a5682148fc4
Authentihash SHA256
1ce001eda18c7a0636c4053848a1ae69812704795ab057331903d7002d688027
Machine
AMD64
Version
Not recorded
Publisher
Not recorded
Download vulnerable sampleView on VirusTotal
PoisonX7.sysSample 17 · HVCI FALSE
MD5
a3838b29ae8bb70e17770dd40f17f731
SHA1
972b0ef424917ebb73b78b34086ce5248a580c30
SHA256
6fbaad2f00afaa94723fa7d5bd46e7ea4babb7ce478a8e7229ce7bd4b85e0f51
Imphash
47c3554d0dee53d4f925ed52484bea12
Authentihash MD5
db166d299a9aa3671c9260869cecbe40
Authentihash SHA1
d47243560273ada0b12276a0592a4a5682148fc4
Authentihash SHA256
1ce001eda18c7a0636c4053848a1ae69812704795ab057331903d7002d688027
Machine
AMD64
Version
Not recorded
Publisher
Not recorded
Download vulnerable sampleView on VirusTotal
PoisonX8.sysSample 18 · HVCI FALSE
MD5
017c0af0e7a0d20435698be60551c3f5
SHA1
235865a817db2735ad3aa92f48296961a0940edc
SHA256
1ca2f1c00d54b14f0f50d54f11cb654eddcc0228967f9942a92f544c75d5bb37
Imphash
47c3554d0dee53d4f925ed52484bea12
Authentihash MD5
db166d299a9aa3671c9260869cecbe40
Authentihash SHA1
d47243560273ada0b12276a0592a4a5682148fc4
Authentihash SHA256
1ce001eda18c7a0636c4053848a1ae69812704795ab057331903d7002d688027
Machine
AMD64
Version
Not recorded
Publisher
Not recorded
Download vulnerable sampleView on VirusTotal
PoisonX9.sysSample 19 · HVCI FALSE
MD5
32c707dbe33860cca0f99d1b4ba1de6f
SHA1
659944f21a8f4c2314a566e2756c60a87cc252ea
SHA256
db5d284b9a9c02f76030ba89fd85c7c8f830f8fe4195cdc1f9cddf15f127125d
Imphash
47c3554d0dee53d4f925ed52484bea12
Authentihash MD5
db166d299a9aa3671c9260869cecbe40
Authentihash SHA1
d47243560273ada0b12276a0592a4a5682148fc4
Authentihash SHA256
1ce001eda18c7a0636c4053848a1ae69812704795ab057331903d7002d688027
Machine
AMD64
Version
Not recorded
Publisher
Not recorded
Download vulnerable sampleView on VirusTotal

Recorded command

sc.exe create PoisonX.sys binPath=C:\windows\temp\PoisonX.sys type=kernel && sc.exe start PoisonX.sys

Kill EDR / Privilege Escalation · Privileges: kernel · OS: Windows 11

Research & references

Acknowledgement: Jehad Abudagga @jehadbudagga