FalconEye

FalconEye: Windows进程注入实时检测软件 FalconEye是一款针对Windows端点的实时进程注入检测软件。它是一个内核模式驱动程序，旨在实时捕获进程注入（实时进行）。由于FalconEye运行在内核模式下，它针对试图逃避各种用户模式挂钩的进程注入技术提供了更强且可靠的防御。 您可以查看我们在2021 Blackhat ASIA Arsenal上的演示以及幻灯片。 项目概览 检测覆盖范围 下表展示了各类进程注入技术的实现状态和检测逻辑。WPM代表WriteProcessMemory。如需测试检测功能，可参考参考文献部分。 技术| 状态| 检测逻辑| 使用的POC...

CVE-2016-7255

CVE-2016-7255 Los controladores en modo kernel en Microsoft Windows Vista SP2, Windows Server 2008 SP2 y R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold y R2, Windows RT 8.1, Windows 10 Gold, 1511 y 1607, y Windows Server 2016 permiten a los usuarios locales obtener privilegios...

CVE-2026-38766

CVE-2026-38766 An issue in Unistal Systems Pvt. Ltd. Protegent 360 v2.0.0.4 allows a local attacker to escalate privileges via a kernel mode driver...

EATGuard

EATGuard Implementazione di una mitigazione per la protezione della Export Address Table, come l'Export Address Filtering EAF Come Funziona Questo progetto è composto da tre binari che, una volta compilati, si trovano in EATGuard\bin. Essi sono: 1. EATGuardApplication.exe - Applicazione...

aegis

Aegis Driver di protezione dei processi in modalità kernel che utilizza ObRegisterCallbacks per rimuovere i permessi di accesso alla memoria dagli handle. Implementazione di base che intercetta la creazione degli handle e rimuove PROCESSVMREAD/WRITE/OPERATION dai tentativi di accesso non...

access_updated

Singular Access Fork aggiornato dibtbd/access con ricerca dinamica di pattern basata su Zydis per la compatibilità con Windows 10/11 Un wrapper di syscall in modalità kernel che consente operazioni privilegiate sui processi senza richiedere handle. Utilizza l'hooking del puntatore a...

APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit

Introduction CoolClient is a backdoor family attributed to the HoneyMyte APT group also known as Mustang Panda that has been used in their cyber-espionage campaigns targeting organizations across Asia and Russia. It supports such capabilities as keylogging, clipboard theft, credential harvesting,...

PT-2026-64265

Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside the Guest's virtualised GPU memory. Out of bounds accesses triggered by malware introduced to a Guest KMD could allow privilege escalation which escapes...

CVE-2026-50396 Windows Kernel-Mode Driver Elevation of Privilege Vulnerability

...

CVE-2026-50393 Windows Kernel-Mode Driver Elevation of Privilege Vulnerability

...

CVE-2026-50393

CVE-2026-50393 is a Windows kernel-mode driver use-after-free vulnerability that enables local privilege escalation by an authorized attacker. The entry is supported by multiple sources in connected documents, including NVD/MSRC summaries. Affected component: Windows Kernel-Mode Drivers (kernel s...

CVE-2026-50393 Windows Kernel-Mode Driver Elevation of Privilege Vulnerability

...

Windows Kernel-Mode Driver Elevation of Privilege Vulnerability

Use after free in Windows Kernel Mode Driver allows an authorized attacker to elevate privileges locally...

PT-2026-58274

Name of the Vulnerable Software and Affected Versions Windows 11 affected versions not specified Windows Server 2025 affected versions not specified Description A use after free issue in the Windows Kernel Mode Driver allows an authorized attacker to elevate privileges locally, potentially granti...

Important: libnvsdm

Issue Overview: NVIDIA Display Driver for Windows and Linux contains a vulnerability in the kernel driver, where a user could cause an incorrect permission assignment for a critical resource. A successful exploit of this vulnerability might lead to data tampering and denial of service...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003674)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003674 advisory. Insufficient input validation in Kernel Mode Driver in IntelR i915 Graphics for Linux before version 5.0 may allow an authenticated user to potentially enable...

CVE-2026-20859 Windows Kernel-Mode Driver Elevation of Privilege Vulnerability

...

CVE-2021-0196

Improper access control in kernel mode driver for some IntelR NUC 9 Extreme Laptop Kits before version 2.2.0.20 may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2025-23277

NVIDIA Display Driver for Linux and Windows contains a vulnerability in the kernel mode driver, where an attacker could access memory outside bounds permitted under normal use cases. A successful exploit of this vulnerability might lead to denial of service, data tampering, or information...

CVE-2025-61155

The GameDriverX64.sys kernel-mode anti-cheat driver v7.23.4.7 and earlier contains an access control vulnerability in one of its IOCTL handlers. A user-mode process can open a handle to the driver device and send specially crafted IOCTL requests. These requests are executed in kernel-mode context...