mirror of
https://github.com/projectdiscovery/nuclei-templates.git
synced 2026-02-06 10:43:18 +08:00
32 lines
1.2 KiB
YAML
32 lines
1.2 KiB
YAML
id: unsigned-kernel-mode-drivers-allowed
|
|
|
|
info:
|
|
name: Installation of Unsigned Kernel-Mode Drivers Allowed
|
|
author: princechaddha
|
|
severity: high
|
|
description: Checks if the system allows installation of unsigned kernel-mode drivers, which can be malicious.
|
|
impact: |
|
|
Unsigned kernel-mode drivers can be malicious and compromise system security.
|
|
remediation: |
|
|
Restrict the installation of unsigned drivers by enforcing driver signature checks.
|
|
tags: drivers,kernel-mode,code,windows-audit
|
|
|
|
self-contained: true
|
|
|
|
code:
|
|
- pre-condition: |
|
|
IsWindows();
|
|
engine:
|
|
- powershell.exe
|
|
args:
|
|
- -ExecutionPolicy
|
|
- Bypass
|
|
pattern: "*.ps1"
|
|
source: |
|
|
if ((Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\DriverInstall' -Name 'BehaviorOnFailedVerify' -ErrorAction SilentlyContinue).BehaviorOnFailedVerify -eq 0) { Write-Output 'Unsigned driver installation allowed'; }
|
|
|
|
matchers:
|
|
- type: word
|
|
words:
|
|
- "Unsigned driver installation allowed"
|
|
# digest: 4a0a00473045022100f7b568eb0e0af2e8d63ebe3577db1342014f499b9179a8fa567846eeee740292022025277085442eaad5787cc6472c4d845d17636a0eece6b01100d1ffc11f5e6327:922c64590222798bb761d5b6d8e72950 |