CmdID / Files

KslD.sys

KSLD file version info

Driver on Windows LOLDrivers vulnerable driver

A known vulnerable driver

from LOLDrivers

T1068Exploitation for Privilege Escalation

Its entryhttps://www.loldrivers.io/drivers/57822c56-6531-4a2e-afbf-96f77dc5fcaf/

1 known sample

1.1.25041.64017 (5f4e0875c06cb7d3b67e5e7e4354b254dda9b0b4) · its entry

2b3195346d9b62b08bb61bb61f0da20b2abb0c726186c09a2e4fa926baacbfc5

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real KslD.sys?

file version info and known copies

ProductMicrosoft Malware Protection, Microsoft Corporation

DescriptionKSLD

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.