{"uuid": "a6201f6f-524d-44bb-885c-6d77554ba458", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-52271", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/180093", "content": "Does killing EDR with a vulnerable driver still work in 2026?\nhttps://www.reddit.com/r/redteamsec/comments/1r9c8mp/does_killing_edr_with_a_vulnerable_driver_still/\n\nPut together a purple team breakdown using the AV-EDR-Killer (https://github.com/xM0kht4r/AV-EDR-Killer) PoC as the red team reference. The short answer is yes, and the driver being abused (wsftprm.sys, CVE-2023-52271) is still not on Microsoft's driver blocklist. \ud83d\udd34 The Attack The driver is legitimately signed by TPZ SOLUCOES DIGITAIS LTDA, so Windows loads it without complaint. Once loaded, an attacker sends a malicious IOCTL (0x22201C) with the target PID in the first 4 bytes. The driver calls ZwTerminateProcess at the kernel level. No PPL bypass needed. EDR is gone. sc create MalDriver binPath=  type= Kernel sc start MalDriver  \ud83d\udd35 Detection Event ID 4697 \u2014 Service Installed Fires when the attacker registers the driver via sc create. Filter for ServiceType: 0x1 (kernel driver) with unexpected binPath locations. This is your earliest detection opportunity \u2014 catch it before the driver ever loads. Sysmon Event ID 6 \u2014 Driver Loaded Logs ImageLoaded path, hashes, and signature info on every driver load. Hash the loaded driver and cross-reference against loldrivers.io (https://www.loldrivers.io/). A signed but known-vulnerable driver loading outside of a sanctioned software install should be an immediate alert. Long-term fix: Enforce a WDAC driver blocklist policy. Don't wait for Microsoft to add it for you. \ud83c\udfaf MITRE ATT&CK  T1562.001 \u2014 Impair Defenses: Disable or Modify Tools T1543.003 \u2014 Create or Modify System Process: Windows Service  Full video walkthrough here: https://youtu.be/q6VMly9Bs5s Covers the full attack chain and how to build detection rules around Event ID 4697 and Sysmon 6. What BYOVD detections are you running in your environment?    submitted by    /u/Infosecsamurai  (https://www.reddit.com/user/Infosecsamurai) \n [link] (https://youtu.be/q6VMly9Bs5s)   [comments] (https://www.reddit.com/r/redteamsec/comments/1r9c8mp/does_killing_edr_with_a_vulnerable_driver_still/)", "creation_timestamp": "2026-09-04T00:01:06.956340Z"}