analyzing-windows-driver-malware

Name: analyzing-windows-driver-malware
Author: meltedinhex

18stars5forks

How to install analyzing-windows-driver-malware?

meltedinhex/analyst-ai-pack/analyzing-windows-driver-malware

$npx -y skills add meltedinhex/analyst-ai-pack --skill analyzing-windows-driver-malware

Installs into the current project.

Summary

Analyzes malicious and vulnerable Windows kernel drivers (.sys) by parsing the PE for

Files · 1

View on GitHub

SKILL.md

1	# Analyzing Windows Driver Malware
2
3	## When to Use
4
5	- You have a `.sys` kernel driver (malicious rootkit driver or a vulnerable driver used for BYOVD)
6	and need to identify its entry, IRP/IOCTL handlers, and dangerous kernel operations.
7	- You are assessing privilege-escalation or kernel-stealth risk.
8
9	Do not use this by loading the driver — analyze it statically. Loading kernel code is
10	dangerous and is the threat itself.
11
12	## Prerequisites
13
14	- The driver `.sys` (read inertly).
15
16	## Safety & Handling
17
18	- Read bytes statically; never install/load the driver. Note its signing status for BYOVD context.
19
20	## Workflow
21
22	### Step 1: Confirm it is a kernel driver
23
24	```bash
25	python scripts/analyst.py inspect driver.sys
26	```
27
28	Verifies the PE native subsystem (1), kernel imports (`ntoskrnl.exe`, `hal.dll`), and reports
29	imported kernel APIs.
30
31	### Step 2: Identify dispatch and dangerous primitives
32
33	Flag IRP/IOCTL handling (`IoCreateDevice`, `IoCreateSymbolicLink`, `IRP_MJ_DEVICE_CONTROL`),
34	arbitrary read/write primitives (`MmMapIoSpace`, `ZwMapViewOfSection`, `MmCopyMemory`), and
35	callback registration (`PsSetCreateProcessNotifyRoutine`, `ObRegisterCallbacks`).
36
37	### Step 3: Assess BYOVD/stealth potential
38
39	Map exposed IOCTLs to capabilities (physical memory access, process kill, token theft) that BYOVD
40	abuse relies on.
41
42	### Step 4: Document
43
44	Record the driver's handlers, dangerous primitives, signing status, and risk.
45
46	## Validation
47
48	- Native subsystem and kernel imports confirm a driver.
49	- Dispatch/IOCTL and dangerous-primitive imports are reported with evidence.
50	- Capabilities are tied to concrete imported APIs.
51
52	## Pitfalls
53
54	- Legitimate vendor drivers that are nonetheless exploitable (BYOVD) — context matters.
55	- Drivers resolving APIs dynamically, hiding imports.
56	- Confusing user-mode helper components with the kernel driver itself.
57
58	## References
59
60	- See [`references/api-reference.md`](references/api-reference.md) for the inspector.
61	- WDK and ATT&CK T1068 references (linked in frontmatter).

People who liked this also viewed

6 picks

Type

find-skillsHelps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express interest in extending capabilities. This skSkillsJul 20262.6M27k
grill-meA relentless interview to sharpen a plan or design.SkillsJul 2026633k182k
vercel-react-best-practicesVercel's official collection of agent skillsSkillsJul 2026573k29k
improve-codebase-architectureScan a codebase for deepening opportunities, present them as a visual HTML report, then grill through whichever one you pick.SkillsJul 2026522k182k
setup-matt-pocock-skillsConfigure this repo for the engineering skills — set up its issue tracker, triage label vocabulary, and domain doc layout. Run once before first use of the other engineering skills.SkillsJul 2026454k182k
triageMove issues and external PRs through a state machine of triage roles — categorise, verify, grill if needed, and write agent-ready briefs.SkillsJul 2026424k182k

analyzing-windows-driver-malware

18stars5forks

View on GitHub

How to install analyzing-windows-driver-malware?

meltedinhex/analyst-ai-pack/analyzing-windows-driver-malware

$npx -y skills add meltedinhex/analyst-ai-pack --skill analyzing-windows-driver-malware

Installs into the current project.

Summary

Analyzes malicious and vulnerable Windows kernel drivers (.sys) by parsing the PE for

Files · 1

View on GitHub

SKILL.md

1	# Analyzing Windows Driver Malware
2
3	## When to Use
4
5	- You have a `.sys` kernel driver (malicious rootkit driver or a vulnerable driver used for BYOVD)
6	and need to identify its entry, IRP/IOCTL handlers, and dangerous kernel operations.
7	- You are assessing privilege-escalation or kernel-stealth risk.
8
9	Do not use this by loading the driver — analyze it statically. Loading kernel code is
10	dangerous and is the threat itself.
11
12	## Prerequisites
13
14	- The driver `.sys` (read inertly).
15
16	## Safety & Handling
17
18	- Read bytes statically; never install/load the driver. Note its signing status for BYOVD context.
19
20	## Workflow
21
22	### Step 1: Confirm it is a kernel driver
23
24	```bash
25	python scripts/analyst.py inspect driver.sys
26	```
27
28	Verifies the PE native subsystem (1), kernel imports (`ntoskrnl.exe`, `hal.dll`), and reports
29	imported kernel APIs.
30
31	### Step 2: Identify dispatch and dangerous primitives
32
33	Flag IRP/IOCTL handling (`IoCreateDevice`, `IoCreateSymbolicLink`, `IRP_MJ_DEVICE_CONTROL`),
34	arbitrary read/write primitives (`MmMapIoSpace`, `ZwMapViewOfSection`, `MmCopyMemory`), and
35	callback registration (`PsSetCreateProcessNotifyRoutine`, `ObRegisterCallbacks`).
36
37	### Step 3: Assess BYOVD/stealth potential
38
39	Map exposed IOCTLs to capabilities (physical memory access, process kill, token theft) that BYOVD
40	abuse relies on.
41
42	### Step 4: Document
43
44	Record the driver's handlers, dangerous primitives, signing status, and risk.
45
46	## Validation
47
48	- Native subsystem and kernel imports confirm a driver.
49	- Dispatch/IOCTL and dangerous-primitive imports are reported with evidence.
50	- Capabilities are tied to concrete imported APIs.
51
52	## Pitfalls
53
54	- Legitimate vendor drivers that are nonetheless exploitable (BYOVD) — context matters.
55	- Drivers resolving APIs dynamically, hiding imports.
56	- Confusing user-mode helper components with the kernel driver itself.
57
58	## References
59
60	- See [`references/api-reference.md`](references/api-reference.md) for the inspector.
61	- WDK and ATT&CK T1068 references (linked in frontmatter).

People who liked this also viewed

6 picks

Type