MITRE ATT&CK™ Exploitation for Privilege Escalation - Technique T1068
Theory
As a security mechanism, Windows by default employs a feature called Driver Signature Enforcement that ensures kernel-mode drivers have been signed by a valid code signing authority before Windows will permit them to run.
However, we may bring a signed vulnerable driver onto a compromised machine so that we can exploit the vulnerability to execute code in kernel mode.
That technique requires administrative privileges on the target.
# -n, Choose process by name, including the .exe suffix# -p, Choose process by PID# -l, List handles of protected process# -k, Kill the protected process by closing its handles# -x, Close a specific handle# -d, Specify path to where ProcExp will be extracted# -s, Specify service name registry key# -u, Unload ProcExp driver# -a, adds SeDebugPrivilege#Examples:#Kill cyserverbackstab.exe-ncyserver.exe-k#Close handle E4C of cyserverbackstab.exe-ncyserver.exe-xE4C#List all handles of cyserverbackstab.exe-ncyserver.exe-l#Kill protected process with PID 4326, extract ProcExp driver to C:\ drivebackstab.exe-p4326-k-dc:\\driver.sys
Truesight.sys is a vulnerable driver from Rogue Anti-Malware Driver 3.3. It can be abuse to kill a PPL process
Darkside
Darkside is a C# AV/EDR Killer that exploit the truesight.sys driver. To exploit, first load and start the driver:
Then, start Darkside by specifing the PID to kill.
Darkside.exe-p <PID>
TrueSightKiller
TrueSightKiller is a CPP AV/EDR Killer that exploit the truesight.sys driver. To exploit, you need to have the truesight.sys driver located at the same location as the executable.
# By porcess nameTrueSightKiller.exe-n <ProcessName.exe># By pidTrueSightKiller.exe-p <PID>
Terminator terminate all EDR/XDR/AVs processes by abusing the zam64.sys driver. To exploit, place the driver Terminator.sys in the same path as the executable
Terminator.exe
Windows Filtering Platform (WPF) Callout Driver
A callout driver implements one or more callouts. Callouts extend the capabilities of the Windows Filtering Platform by processing TCP/IP-based network data in ways that are beyond the scope of the simple filtering functionality. By exploiting such driver we can block outbound traffic from EDR processes.
EDRPrison leverages a legitimate WFP callout driver, WinDivert, to effectively silence EDR systems. This project focuses on network-based evasion techniques.
EDRPrison.exe
Kernel Object Tampering
EDRSandblast is a tool written in C that weaponize a vulnerable signed driver to bypass EDR detections (Notify Routine callbacks, Object Callbacks and ETW TI provider) and LSASS protections. Multiple userland unhooking techniques are also implemented to evade userland monitoring.
The technique will not work on HVCI systems due to the impossibility to change the LSTAR pointers if protected by the Hyper-V
DriverJack is a tool designed to load a vulnerable driver by abusing lesser-known NTFS techniques. These method bypass the registration of a Driver Service on the system by hijacking an existing service, and also spoof the image path presented in the Driver Load event. To further masquerade the presence of a vulnerable driver, the attack also abuses an Emulated Filesystem Read-Only bypass to swap the content of a driver file on a mounted ISO before loading it.
