mitre att&ck technique
T1068
Exploitation for Privilege Escalation
3 posts cover this technique
-
T1068 - gdrv.sys Load Attempt - EDR Detection Queries
EDR detection queries for identifying BYOVD exploitation attempts using the vulnerable gdrv.sys Gigabyte driver.
-
T1068 - Vulnerable Driver Write Response Playbook
Incident response playbook for handling BYOVD alerts involving vulnerable kernel drivers like gdrv.sys, covering identification, containment, remediation, and recovery.
-
T1068 - gdrv.sys - Removal and Blocklist Validation
Remediation checklist for removing the vulnerable gdrv.sys driver, validating EDR quarantine, and enforcing the Microsoft kernel-mode driver blocklist.