SakDriver Rootkit: Windows Kernel Malware That Blinds EDR and Hides in the Registry
What initially appeared to be a routine Cobalt Strike Beacon turned out to be something considerably more dangerous. Researchers have now dissected SakDriver – a fully realized Windows rootkit capable of operating at the kernel level, concealing processes and network connections, suppressing event telemetry, and executing commands with the highest privileges the operating system can confer.
Ring 0 Access and ETW Tampering
As documented in the detailed SakDriver kernel driver reversal published by core-jmp, the malware loads as a driver and immediately acquires access to Ring 0 – the most privileged execution layer in the Windows architecture.
From this position, SakDriver interferes directly with Event Tracing for Windows. By corrupting this telemetry pipeline, the rootkit prevents security solutions from collecting accurate records of system activity. Defenders are, in effect, blinded before they can observe what is happening.
Process and Network Concealment
To hide running processes, SakDriver employs Direct Kernel Object Manipulation – commonly abbreviated as DKOM. This technique modifies kernel data structures in memory directly, unlinking target processes from the lists that the operating system and security tools query when enumerating what is running.
Network concealment follows a different approach. SakDriver intercepts the Network Store Interface driver to suppress visibility of specific listening ports. The hidden ports include 6891, 6543, 7543, 9199, and several ports in the 12341-12343 range.
A Registry-Based Command Channel
One of SakDriver’s most distinctive design choices is its command-and-control mechanism. Rather than receiving instructions directly over the network – a pattern that endpoint detection tools readily flag – the rootkit registers a kernel callback that monitors a specific Windows Registry value.
A companion process writes encoded command data into this registry entry. The rootkit’s registered handler intercepts the write operation, validates a special byte sequence embedded in the data, and relays the instruction to the driver. This architecture substantially reduces the volume of suspicious network and system calls that behavioral detection engines might otherwise observe.
A Command Table of Over Two Dozen Capabilities
Researchers reconstructed a command dispatch table containing more than twenty distinct operations. SakDriver’s documented capabilities include:
reading and modifying the memory of arbitrary processes; accessing raw physical memory; injecting libraries and executable shellcode into running processes; deleting protected files; altering memory page access permissions; loading PE files directly from memory without touching the file system; simulating keyboard and mouse input; and spoofing hardware identifiers – including disk serial numbers, NVIDIA GPU identifiers, and SMBIOS data.
Persistence: Masquerading as a Microsoft Service
For persistence, the malicious driver writes itself to the Windows\System32\drivers directory under a filename matching the pattern sak_XXX.sys. SakDriver then creates a service named msXXXX and disguises it as “Microsoft Player Service.”
Furthermore, the rootkit registers as a file system minifilter driver. This registration allows it to intercept directory enumeration requests and suppress its own files from appearing in antivirus scans – a self-concealment layer that operates below the file system API level most security tools consume.
Registry and Network Protection
SakDriver actively defends its own configuration. It blocks attempts to modify the registry keys associated with its service entry. Additionally, the rootkit leverages the Windows Filtering Platform to prevent security products from establishing connections to the operators’ infrastructure – effectively isolating defensive tools from their own update and telemetry endpoints.
Anti-Analysis and Sandbox Evasion
To complicate dynamic and static analysis, SakDriver incorporates several evasion techniques. It examines hypervisor timing characteristics to detect sandbox environments. Rather than importing kernel function addresses through a standard import table – which would immediately reveal its purpose during static analysis – the rootkit resolves all required addresses at runtime by parsing the export table of ntoskrnl.exe directly.
The result is a driver binary with no obvious import footprint, presenting significant obstacles to automated classification.
Artifacts Left Behind
Despite its sophistication, the developer left several recoverable forensic traces. The sample retains a debug PDB path referencing CrackerDrv.pdb. If installation fails at a particular stage, the service may register under the plaintext name SakDriver rather than its disguised alias.
Researchers have published the sample hash, network indicators of compromise, and a YARA rule suitable for hunting the malicious driver across endpoint telemetry and memory images.
Why Kernel-Level Malware Is Especially Dangerous
The SakDriver analysis illustrates the profound asymmetry that kernel-level malware creates. This rootkit does not merely conceal a single process. It subverts the logging subsystem, the file system layer, the network stack, and memory management simultaneously.
Security solutions that rely exclusively on telemetry sourced from the operating system itself may observe only a fraction of the activity occurring on a compromised host. Effective detection of threats at this privilege level requires kernel-aware tooling, integrity verification of driver loads, and monitoring approaches that operate independently of the OS telemetry pipeline the rootkit has already compromised.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
