Overview

• This is an older driver that was recently exploited in a BYOVD campaign detailed here: https://www.bleepingcomputer.com/news/security/edr-killer-tool-uses-signed-kernel-driver-from-forensic-software/
• The exploit path is as follows:
  1. The attacker's program runs as admin and gets its own Process ID using GetCurrentProcessId()
  2. It constructs a 16-byte buffer for the KillProc IOCTL (0x223078)
  3. It writes its own PID into th efirst 8 bytes of the buffer
  4. It writes the target's PID into the second 8 bytes of the buffer
  5. It calls DeviceIoControl
  6. The driver's validation function receives the buffer and compares the first 8 bytes of the caller's PID to see if the check passes
  7. The dispatcher then calls KillProc, which reads the target's PID from the second 8 bytes and terminates the process

Affected versions (as tested):

• Version [EnCase Driver for WinNET 64 bit Svn Rev:98733 with EnCase 7.9.6.3] - SHA-256: d42f1b420747b82533e33107c710c45c29ff20aa5da3d1c8498b7bed7f9ebc81