Add KslD.sys (Windows Defender Support Driver)

[Pumi96]

Description

KslD.sys is a legitimate Microsoft-signed Windows Defender driver abused as a Living off the Land vector for unrestricted kernel memory access. It provides capabilities to read physical and virtual memory, defeat KASLR, and dump LSASS credentials by bypassing PPL. Attackers hijack its weak process-name validation via the SharedState registry.

Technical Details

• Driver: KslD.sys (Microsoft Malware Protection Kernel Support Driver)
• Vulnerability: Unrestricted physical and virtual memory read primitives via IOCTL 0x222044.
• Weaponization: Used to bypass KASLR, enumerate process tokens, and dump LSASS memory directly via physical page table walks (bypassing PPL without opening a process handle).
• Bypass Mechanism: Administrator modification of the SharedState registry key redirects the driver's hardcoded NT process-name check to an attacker-controlled executable.

Changes Made

• Added ksld.yaml to the yaml/ directory.
• Included MD5, SHA1, and SHA256 hashes for the tested version (4.18.26010.5).
• Provided the service creation and registry modification commands used for exploitation.
• Added Sigma rule reference for detection.

[ruppde]

this driver is used by multiple hacktools:
https://github.com/vergamota/KslKatz
https://github.com/andreisss/KslDump
https://github.com/carved4/gokatz
https://github.com/Muz1K1zuM/kslkatz_bof

[nasbench]

Thanks for the contribution. Please do include sample(s) of this driver as LFS uploaded to this repo in the right folder (see other examples).

Also run the https://github.com/magicsword-io/LOLDrivers/blob/main/bin/metadata-extractor.py so that the other fields are filled. See other examples on the repo please

cc @MHaggis when you have time, could you take care of this.

[Pumi96]

Also this driver is used by pumi96 inside this repo:
https://github.com/Pumi96/DefenderDump

[Pumi96]

Hey, I've uploaded the driver sample to the drivers directory and provided the fully enriched YAML with all the correct hashes in the yaml directory. It should be good to go, please review.

[MHaggis]

I rebuilt this as a clean maintainer PR in #364. The current fork branch includes the intended KslD sample plus a generated yaml/.yaml with an empty Id and hundreds of unrelated YAML modifications. I could not push the cleaned LFS binary back to this fork branch because GitHub denied LFS object upload to the fork, even with maintainer edits enabled.

[MHaggis]

Updated this PR in-place so the diff is now scoped to the KslD entry only: .gitattributes, the KslD driver LFS pointer, and yaml/57822c56-6531-4a2e-afbf-96f77dc5fcaf.yaml.\n\nValidation run locally from the updated branch:\n\n\npython3 bin/validate.py\nNo Errors found\n\n\nI also confirmed the sample metadata against VT and retained the original submitter/author credit in the YAML. The duplicate replacement PR (#364) is being closed in favor of this existing PR.

[MHaggis]

Follow-up: the updated in-place KslD PR is now clean against main and the approved fork workflow passed.\n\nCurrent status:\n- Merge state: clean\n- validate-yaml: success\n- Diff scoped to .gitattributes, drivers/b316425d6f200244a25bd7b9998d9c43.bin, and yaml/57822c56-6531-4a2e-afbf-96f77dc5fcaf.yaml\n\nThis should be ready for reviewer re-check of the earlier requested changes.