reverse-skills-max/vendor-new/analyst-ai-pack/skills/analyzing-windows-driver-malware/SKILL.md

name, description, domain, subdomain, tags, version, author, license, mitre_attack, d3fend, references

name	description	domain	subdomain	tags	version	author	license	mitre_attack	d3fend	references
analyzing-windows-driver-malware	Analyzes malicious and vulnerable Windows kernel drivers (.sys) by parsing the PE for the native subsystem, identifying DriverEntry/IRP dispatch and IOCTL handlers, and flagging BYOVD and kernel-callback abuse. Activates for requests to analyze a Windows driver, examine a .sys sample, or assess a BYOVD/kernel driver threat.	cybersecurity	reverse-engineering	reverse-engineering windows-driver kernel byovd ioctl	1.0.0	analyst-ai-pack	Apache-2.0	T1068 T1014 T1547.006	D3-SDA D3-FA	Windows Driver Kit (WDM/IRP) — https://learn.microsoft.com/windows-hardware/drivers/ MITRE ATT&CK T1068 Exploitation for Privilege Escalation — https://attack.mitre.org/techniques/T1068/

Analyzing Windows Driver Malware

When to Use

• You have a .sys kernel driver (malicious rootkit driver or a vulnerable driver used for BYOVD) and need to identify its entry, IRP/IOCTL handlers, and dangerous kernel operations.
• You are assessing privilege-escalation or kernel-stealth risk.

Do not use this by loading the driver — analyze it statically. Loading kernel code is dangerous and is the threat itself.

Prerequisites

• The driver .sys (read inertly).

Safety & Handling

• Read bytes statically; never install/load the driver. Note its signing status for BYOVD context.

Workflow

Step 1: Confirm it is a kernel driver

python scripts/analyst.py inspect driver.sys

Verifies the PE native subsystem (1), kernel imports (ntoskrnl.exe, hal.dll), and reports imported kernel APIs.

Step 2: Identify dispatch and dangerous primitives

Flag IRP/IOCTL handling (IoCreateDevice, IoCreateSymbolicLink, IRP_MJ_DEVICE_CONTROL), arbitrary read/write primitives (MmMapIoSpace, ZwMapViewOfSection, MmCopyMemory), and callback registration (PsSetCreateProcessNotifyRoutine, ObRegisterCallbacks).

Step 3: Assess BYOVD/stealth potential

Map exposed IOCTLs to capabilities (physical memory access, process kill, token theft) that BYOVD abuse relies on.

Step 4: Document

Record the driver's handlers, dangerous primitives, signing status, and risk.

Validation

• Native subsystem and kernel imports confirm a driver.
• Dispatch/IOCTL and dangerous-primitive imports are reported with evidence.
• Capabilities are tied to concrete imported APIs.

Pitfalls

• Legitimate vendor drivers that are nonetheless exploitable (BYOVD) — context matters.
• Drivers resolving APIs dynamically, hiding imports.
• Confusing user-mode helper components with the kernel driver itself.

References

• See references/api-reference.md for the inspector.
• WDK and ATT&CK T1068 references (linked in frontmatter).