Loading story…
The kgameprotect.sys driver (version 2.7.1.7) exposes IOCTL 0x222048 through the \\.\kgameprotect device interface. Its handler accepts a caller-provided process ID, opens that process from kernel mode with PROCESS_TERMINATE access, and calls ZwTerminateProcess, without validating the caller, a registered client, or the target PID.
The flaw could provide a local attacker a means to terminate endpoint-security or other critical user-mode processes, subject to whether unprivileged users can open the device and whether the target is protected by the Windows configuration. The analyzed driver also registers a file-system minifilter, so deployment requires proper minifilter installation; compatibility with Hypervisor-Protected Code Integrity (HVCI) was not established for the sampled version.
Get the actors, campaigns, and ATT&CK mapping behind it.
1 event from the most recent confirmed update back to the earliest known activity.
LOLDrivers added a record for kgameprotect.sys version 2.7.1.7 after identifying IOCTL 0x222048, which opens a caller-selected process with PROCESS_TERMINATE access from kernel mode and calls ZwTerminateProcess without authorization checks. The finding was attributed to Shiroko; review did not confirm unprivileged device access or termination of protected processes across all Windows configurations.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
loldrivers.io
Open sourcelearn.microsoft.com
Open sourcelearn.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The legacy Prevx Scanner driver `pxscan.sys` version 3.0.5.220 exposes kernel-mode file-manipulation and process-termination functionality through IOCTL `0x22E044`. Static analysis found that the driver reads configurable targets from its service registry key, then can delete chosen files and terminate matching processes from kernel context. The process-killing capability is tracked as **CVE-2025-60349**. An attacker with administrative or `LocalSystem` privileges could abuse the driver in a bring-your-own-vulnerable-driver (BYOVD) scenario to disable endpoint security processes or remove defensive files. The exposed device is limited to `LocalSystem` and Builtin Administrators, and modifying the service configuration also requires elevated access; therefore, the flaw is not a direct privilege-escalation route for standard users.
Sep 18, 2026
Elastic Security Labs warned that ransomware operators increasingly use legitimately signed but vulnerable Windows drivers to gain kernel-mode execution, tamper with endpoint defenses, and encrypt systems. The researchers identified an unrestricted handle-duplication flaw in the Microsoft Sysinternals Process Explorer driver that a user-mode attacker could exploit to access raw physical memory, enabling arbitrary kernel read/write operations or kernel code execution. Organizations should treat vulnerable signed drivers as a high-risk attack path and block known-abused drivers before they load. Elastic recommends combining vulnerable-driver blocklists, Windows Defender Application Control (WDAC) driver allowlisting, behavioral protections, and monitoring for first-seen or anomalous driver loads; Elastic Endpoint 8.3 and later validates drivers against its blocklist prior to loading.
Aug 26, 2026
Researchers disclosed two signed Windows kernel drivers that can be abused in **bring-your-own-vulnerable-driver (BYOVD)** attacks to gain elevated privileges and bypass platform protections. Motorola's `SmSerl64.sys` from the SM56 Modem WDM Driver package (`6.12.23.0`) was reported as vulnerable to crafted `IOCTL` requests that let low-privileged users map physical memory, enabling privilege escalation, high-privilege code execution, and information disclosure; the issue is tracked as **`CVE-2024-55414`**. Separately, Patrick Saif reported that `ComputerZ_x64.sys`, shipped with Chengdu Qilu Technology's widely distributed Master Lu utility, exposes dangerous kernel primitives including arbitrary physical memory reads, unrestricted `MSR` reads that can defeat `KASLR`, weakly filtered port I/O, and unrestricted PCI configuration writes. Both drivers are signed and therefore attractive for abuse on systems that enforce driver-signing requirements. The Master Lu driver reportedly is not on Microsoft's `HVCI` blocklist and can load on modern x64 Windows systems, while the Motorola driver has been added to LOLDrivers with recommendations to block `SmSerl64.sys` across endpoints and use published **YARA** and **Sigma** detections. In testing, the Master Lu proof of concept reportedly succeeded in loading the driver, accessing the device, reading `IA32_LSTAR`, reading physical memory, and performing PCI and port I/O operations, underscoring the risk that legitimate but vulnerable drivers can provide attackers with direct kernel-level capabilities.
Jun 29, 2026