Sigurd (Old Norse: Sigurðr) was a legendary Norse hero who killed the dragon Fafnir and possessed the cursed treasure.
Sigurd is a BYOVD (aka Bring Your Own Vulnerable Driver) exploitation tool, made to kill processes. This tool allow you to prepare custom config(toml or json), or config it on run using TUI, making it easy to use. It also allow you to exploit multiply drivers, without carrying them around (you choose what to include at compile time).
Warning
This tool was created for authorized security research and testing only. The authors and distributors accept no liability for misuse. Before using it, make sure you have lawful authorization and know what are you doing. Happy pwning!
BYOVD technique implies installing a vulnerable and signed driver on system, in order to exploit it's known vulnerability to gain privileges, read system secrets or (in our case) - kill processes. You can read more about it at Microsoft Security Experts Blog.
To find some details and links to articles about used drivers, see Drivers section.
You can download stable release binary from Github Release page. It includes only default drivers and no trace output (see the list of driver in release text).
All you need is lastest rust tool chain on you Windows machine (or on any other machine, in case you know what are you doing). You can find the standalone installers here.
After installing rust toolchain, just clone the repository and enter project directory:
git clone https://github.com/I3r1h0n/Sigurd
cd Sigurd/sigurdNow it all depends on what drivers you want to use. You can include only desired ones, by changing the set of cargo features. Below is an example build command, with basic set of drivers and no trace messages:
cargo build --release --no-default-features --features "throttlestop bdapiutil64 k7rkscan wsftprm"After build is finished, you can find binary in /sigurd/target/release folder.
Usage is pretty simple. Below is the help output.
> .\sigurd.exe --help
BYOVD technique
Usage: sigurd.exe [OPTIONS]
Options:
-c, --config <CONFIG> Path to .toml config file
--config-string <CONFIG_STRING> TOML configuration as a quoted string
-s, --silent Run app without interface
-h, --help Print help
-V, --version Print versionDefault config may look like this:
driver_name = "ThrottleStop"
installation_path = 'C:\ProgramData'
victim_processes = [
"notepad.exe",
]
continuous = false
uninstall = trueYou can:
- Save it next to executable as
Config.toml, - Save it somewhere else, and provide it's path via
--config - Convert it to valid JSON and pass it as
--config-string - Or start without any config and configure Sigurd on run
Silent mode allows you to run without starting a Terminal User Interface. Just provide a valid config, and sigurd will use it as is.
Here is the demo showing it use the ThrottleStop.sys to kill notepad.exe and MsMpEng.exe:
Table of the currently implemented drivers.
| Driver | Version | CVE | Details | Status |
|---|---|---|---|---|
| PhantomKiller | 2.5.30.11281 | - | Article | Not on LoL |
| AppRemover Driver | v2017.10.02.1551 | CVE-2026-36425 | Github | Not on LoL |
| PoisonX | 0.0.1 | - | Discoverer | Not on LoL |
| STProcessMonitor | 11.11.4 | CVE-2026-0828 | Public post | Not on LoL |
| GameDriverX64 | 7.23.4.7 | CVE-2025-61155 | Blog | Non on LoL |
| eb.sys | 0.0.1 | - | Github | Not on LoL |
| CcProtect.sys | 1.3.2.1 | - | Github | Not on LoL |
| K7 driver | 15.1.0.6 | CVE-2025-1055 | LolDrivers | On LoL |
| ThrottleStop | 3.0.0.0 | CVE-2025-7771 | SecureList | Not on LoL |
| BdApiUtil64 | 5.0.3.18797 | CVE-2024-51324 | LolDrivers | On LoL |
| WSFTPrm | 2.0.0.0 | CVE-2023-52271 | research | Not on LoL? |
| wamsdk | 1.1.100 | - | Checkpoint | Blocked |
| KsAPI64 | 1.0.591.131 | - | - | Blocked |
You can find all driver files in sigurd/drivers folder.
See the original PhantomKiller and AppRemover by j3h4ck. There is actually 16 AppRemover drivers, I added the first one, but you can swap it's file with any other ardrv from j3h4ck repo.
I also didn't include the ksapi64 and wamsdk driver to default features list, because it's been blocked by windows vulnerable driver block list.
ThrottleStop is a special case, since it's not so 'naive' BYOVD EDR Killer driver. It allow an arbitrary physical memory read/write, and because of that - exploiting it as a EDR killer is a little more complicated then just sending a correct struct in IOCTL request. See the details
Creation of Sigurd is higly inspired by this project by BlackSnufkin. Also big thanks to Kaspersky for thair analyze on ThrottleStop.
If you have an idea on how to improve this project, want to report a bug, or willing to implement another driver exploit - feel free to open an issue or pull request.
All you need to add a new driver to sigurd is implement a KillerDriver trait. See it in the /sigurd/src/drivers/mod.rs and check the /sigurd/src/drivers/k7rkscan/mod.rs as an example.
prod by I3r1h0n.