Loading story…
The legacy Prevx Scanner driver pxscan.sys version 3.0.5.220 exposes kernel-mode file-manipulation and process-termination functionality through IOCTL 0x22E044. Static analysis found that the driver reads configurable targets from its service registry key, then can delete chosen files and terminate matching processes from kernel context. The process-killing capability is tracked as CVE-2025-60349.
An attacker with administrative or LocalSystem privileges could abuse the driver in a bring-your-own-vulnerable-driver (BYOVD) scenario to disable endpoint security processes or remove defensive files. The exposed device is limited to LocalSystem and Builtin Administrators, and modifying the service configuration also requires elevated access; therefore, the flaw is not a direct privilege-escalation route for standard users.
Get the actors, campaigns, and ATT&CK mapping behind it.
1 event from the most recent confirmed update back to the earliest known activity.
The legacy Prevx Scanner driver pxscan.sys version 3.0.5.220 was documented as allowing configurable process termination from kernel context through IOCTL 0x22E044. The behavior can provide a privileged BYOVD primitive for security-tool evasion, but access is restricted to LocalSystem and Builtin Administrators.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The `kgameprotect.sys` driver (version 2.7.1.7) exposes IOCTL `0x222048` through the `\\.\kgameprotect` device interface. Its handler accepts a caller-provided process ID, opens that process from kernel mode with `PROCESS_TERMINATE` access, and calls `ZwTerminateProcess`, without validating the caller, a registered client, or the target PID. The flaw could provide a local attacker a means to terminate endpoint-security or other critical user-mode processes, subject to whether unprivileged users can open the device and whether the target is protected by the Windows configuration. The analyzed driver also registers a file-system minifilter, so deployment requires proper minifilter installation; compatibility with Hypervisor-Protected Code Integrity (HVCI) was not established for the sampled version.
Sep 18, 2026
Sophos X-Ops reported that the **AuKill** malware uses a bring-your-own-vulnerable-driver (**BYOVD**) technique to disable endpoint detection and response tools before follow-on payloads such as ransomware or backdoors are deployed. The tool abuses an outdated, Microsoft-signed Process Explorer driver, `PROCEXP.SYS`, and was linked to at least three intrusions involving ransomware operators including **Medusa Locker** and **LockBit**. Researchers identified six variants developed between late 2022 and early 2023, indicating active refinement of the malware. AuKill requires administrative privileges, installs itself as a Windows service, drops the vulnerable driver into the system drivers directory, and repeatedly kills processes and disables services tied to security products; some versions also unload defensive drivers. Sophos said the malware shares strong code and behavioral similarities with the open-source **Backstab** project, suggesting the author reused existing offensive techniques to build the tool. The findings highlight continued criminal use of signed but vulnerable drivers to evade defenses and weaken security controls ahead of broader compromise.
Jun 29, 2026
Elastic Security Labs warned that ransomware operators increasingly use legitimately signed but vulnerable Windows drivers to gain kernel-mode execution, tamper with endpoint defenses, and encrypt systems. The researchers identified an unrestricted handle-duplication flaw in the Microsoft Sysinternals Process Explorer driver that a user-mode attacker could exploit to access raw physical memory, enabling arbitrary kernel read/write operations or kernel code execution. Organizations should treat vulnerable signed drivers as a high-risk attack path and block known-abused drivers before they load. Elastic recommends combining vulnerable-driver blocklists, Windows Defender Application Control (WDAC) driver allowlisting, behavioral protections, and monitoring for first-seen or anomalous driver loads; Elastic Endpoint 8.3 and later validates drivers against its blocklist prior to loading.
Aug 26, 2026