Analyzing Windows Driver Malware
Analyzes malicious and vulnerable Windows kernel drivers (.sys) by parsing the PE for
Install
$ agentstack add skill-meltedinhex-analyst-ai-pack-analyzing-windows-driver-malware ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Links to your public security report.[](https://agentstack.voostack.com/security/report/skill-meltedinhex-analyst-ai-pack-analyzing-windows-driver-malware) Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
Analyzing Windows Driver Malware
When to Use
- You have a
.syskernel driver (malicious rootkit driver or a vulnerable driver used for BYOVD)
and need to identify its entry, IRP/IOCTL handlers, and dangerous kernel operations.
- You are assessing privilege-escalation or kernel-stealth risk.
Do not use this by loading the driver — analyze it statically. Loading kernel code is dangerous and is the threat itself.
Prerequisites
- The driver
.sys(read inertly).
Safety & Handling
- Read bytes statically; never install/load the driver. Note its signing status for BYOVD context.
Workflow
Step 1: Confirm it is a kernel driver
python scripts/analyst.py inspect driver.sysVerifies the PE native subsystem (1), kernel imports (ntoskrnl.exe, hal.dll), and reports imported kernel APIs.
Step 2: Identify dispatch and dangerous primitives
Flag IRP/IOCTL handling (IoCreateDevice, IoCreateSymbolicLink, IRP_MJ_DEVICE_CONTROL), arbitrary read/write primitives (MmMapIoSpace, ZwMapViewOfSection, MmCopyMemory), and callback registration (PsSetCreateProcessNotifyRoutine, ObRegisterCallbacks).
Step 3: Assess BYOVD/stealth potential
Map exposed IOCTLs to capabilities (physical memory access, process kill, token theft) that BYOVD abuse relies on.
Step 4: Document
Record the driver's handlers, dangerous primitives, signing status, and risk.
Validation
- Native subsystem and kernel imports confirm a driver.
- Dispatch/IOCTL and dangerous-primitive imports are reported with evidence.
- Capabilities are tied to concrete imported APIs.
Pitfalls
- Legitimate vendor drivers that are nonetheless exploitable (BYOVD) — context matters.
- Drivers resolving APIs dynamically, hiding imports.
- Confusing user-mode helper components with the kernel driver itself.
References
- See [
references/api-reference.md](references/api-reference.md) for the inspector. - WDK and ATT&CK T1068 references (linked in frontmatter).
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: meltedinhex
- Source: meltedinhex/analyst-ai-pack
- License: Apache-2.0
- Homepage: https://meltedinhex.com/
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.