PoisonX Rootkit: A Signed Kernel Driver That Turns Your EDR Into a Target
PoisonX: A Signed Kernel Driver That Turns Your EDR Into a Target A Microsoft-signed BYOVD driver used to kill CrowdStrike Falcon and other security tooling from Ring 0.
- BYOVD
Bottom line. Treat any PoisonX.sys load as a pre-intrusion kill-switch for your EDR. Signature checking alone will not stop it, enforce driver allow-listing (WDAC) and memory integrity (HVCI), and hunt for new kernel-service installs (Event ID 7045) and unexpected termination of security processes now.
Background
PoisonX is a signed Windows kernel driver observed in an April 2026 spear-phishing campaign against organizations in Japan and China. Delivered alongside a modular RAT tracked as 10FXRAT (aka PoisonX RAT), the driver gives the operator a Ring 0 process-kill primitive that neutralizes Protected Process Light (PPL) defenses which normally block user-mode tampering with EDR.
The technique is Bring-Your-Own-Vulnerable-Driver (BYOVD): on 64-bit Windows, Driver Signature Enforcement (DSE) only allows signed drivers to load, so adversaries source signed-but-abusable drivers rather than writing unsigned ones. PoisonX.sys was found signed with a valid Microsoft Hardware Compatibility signature across a family of 15+ versions, and scored 0/71 on VirusTotal at initial discovery, signed did not mean safe.
What we observed
Reverse-engineering the driver and the surrounding campaign surfaced the following:
- The malicious logic is wrapped in a single undocumented IOCTL handler. Sending IOCTL 0x22E010 with a target PID (as a null-terminated ASCII decimal string) invokes a procKiller routine that calls ZwOpenProcess then ZwTerminateProcess on that PID. From kernel mode, ZwOpenProcess does not enforce PPL, so a PPL-protected sensor such as CrowdStrike Falcon is opened and killed. On success the driver simply writes ‘ok’ back to the output buffer.
- The device is reachable via the symbolic link \\.\{F8284233-48F4-4680-ADDD-F8284233}. Any process that can open that device handle can kill any PID. There are no signature checks, ACLs, or privilege validation in the handler. It implicitly trusts that only privileged callers will find it.
- The full chain begins with a spear-phishing email (often HR-themed) linking to a ZIP/RAR on Google Cloud Storage. An LNK shortcut runs curl.exe to fetch the ‘PXDropper’ component, which writes PoisonX.sys and the 10FXRAT implant, installs the driver as a kernel service, and establishes persistence via Run keys and service creation.
- 10FXRAT is a modular HTTP/S remote access tool (loader usoclient64.exe, helper dnssd.dll, encrypted runtime.bin) that sets up an internal SOCKS5 proxy and supports file exfiltration, lateral movement, keylogging and credential theft. The driver also filters/hides network traffic, with a 0x58463031 magic value observed in TCP payloads.
- Later variants swapped PoisonX.sys for other legitimate signed drivers, EneIo64.sys (ASUSTeK) and procexp.sys, confirming the operators rotate drivers, which defeats blocklist-only defenses. The abuse pattern mirrors prior cases such as GMER’s process-kill IOCTL and Safetica’s ProcessMonitorDriver.sys (CVE-2026-0828).
PoisonX attack chain
Signed driver load is the pivot, after it, killing the EDR is a single IOCTL.
Attribution
We assess with moderate confidence that PoisonX is operated by a capable, likely espionage-motivated crew, based on regional targeting (Japan and China), spear-phishing tradecraft, and a modular RAT with proxying and credential-theft plugins. No confirmed real-world identity is asserted; attribution rests on public reporting and behavioural/infrastructure evidence rather than a named actor.
Confidence: 70%.
Once the driver is loaded, the attacker no longer needs a noisy exploit, just a device handle, an IOCTL, and a PID to sever your telemetry before the intrusion begins.
Tactics, techniques & procedures (MITRE ATT&CK)
Techniques below are drawn directly from the analysed samples/reporting – no technique is asserted without evidence:
| Tactic | Technique | ID | Evidence |
|---|---|---|---|
| Initial Access | Spearphishing Link | T1566.002 | Emails link to a malicious LNK/EXE hosted on Google Cloud Storage. |
| Execution | Malicious File (LNK) | T1204.002 | LNK shortcut runs curl.exe to download the PXDropper payload. |
| Persistence | Windows Service | T1543.003 | PoisonX.sys installed as a kernel-mode service; dropper also creates services. |
| Persistence | Registry Run Keys | T1547.001 | PXDropper adds Run-key entries for autostart. |
| Privilege Escalation | Exploitation for Privilege Escalation | T1068 | Loads a signed vulnerable driver to obtain kernel (Ring 0) execution. |
| Defense Evasion | Rootkit | T1014 | Kernel driver hides processes and filters network traffic (0x58463031 TCP magic). |
| Defense Evasion | Impair Defenses: Disable or Modify Tools | T1562.001 | IOCTL 0x22E010 terminates PPL-protected EDR/AV processes from kernel mode; Defender exclusions added. |
| Discovery | Security Software Discovery | T1518.001 | Enumerates running security products to select termination targets. |
| Command and Control | Remote Access Tools | T1219 | 10FXRAT establishes encrypted HTTP/S C2 with an internal SOCKS5 tunnel. |
| Command and Control | Proxy | T1090 | 10FXRAT sets up an internal SOCKS5 proxy for traffic forwarding. |
MITRE ATT&CK techniques by tactic
Indicators of compromise
Defenders can block or hunt the following:
| Indicator | Type | Note |
|---|---|---|
PoisonX[.]sys | sha256 | Signed kernel driver (family of 15+ signed versions); pivot on file name/signer, not a single hash |
| \\[.]\{F8284233-48F4-4680-ADDD-F8284233} | url | Driver device symbolic link / device object name |
| 0x22E010 | url | Kill IOCTL control code passed to DeviceIoControl with target PID |
usoclient64[.]exe | sha256 | 10FXRAT loader (masquerades as legitimate Windows binary) |
dnssd[.]dll | sha256 | 10FXRAT C2 helper library |
runtime[.]bin | sha256 | Encrypted 10FXRAT config / plugin blob |
EneIo64[.]sys | sha256 | Legitimate ASUSTeK driver abused in later BYOVD variants |
procexp[.]sys | sha256 | Legitimate Sysinternals/Microsoft driver abused in later variants |
| 0x58463031 | url | Magic value observed in 10FXRAT TCP payloads (network hunt signature) |
Detection
Copy-ready hunting query:
index=windows (EventCode=7045 OR EventCode=4697)
| eval driver=lower(coalesce(ServiceFileName, ImagePath))
| search (driver="*poisonx.sys*" OR driver="*eneio64.sys*" OR driver="*procexp.sys*") OR ServiceType="kernel mode driver"
| stats count min(_time) as first_seen values(driver) as driver by host, ServiceName, user
| where count > 0Recommendations
- Enforce driver allow-listing with Windows Defender Application Control (WDAC): a curated allow-list beats blocklists, because the operators rotate signed drivers (PoisonX.sys -> EneIo64.sys -> procexp.sys).
- Enable Hypervisor-Protected Code Integrity (HVCI / Memory Integrity) and, in cloud, features like Azure Trusted Launch to constrain what a loaded driver can do in kernel mode.
- Keep the Microsoft vulnerable-driver blocklist current and alert on new kernel-service installs via Event ID 7045 / 4697, especially services with randomized HID-style names.
- Hunt for unexpected termination of security processes (e.g. CSFalconService, MsMpEng.exe) correlated with a recent driver-load event, and for the device object \\.\{F8284233-48F4-4680-ADDD-F8284233}.
- Block outbound traffic to known C2 and inspect for the 0x58463031 magic value in TCP payloads; monitor for curl.exe fetching payloads and LNK files with double extensions from cloud storage.
- On confirmed detection: isolate the host, capture memory, unload the driver where possible, terminate 10FXRAT processes, restore altered registry/Defender settings, and run a full forensic review of persistence and C2.
