Exploring malicious Windows drivers (Part 2): the I/O system, IRPs, stack locations, IOCTLs and more
Summary: Cisco Talos published the second entry in its series on malicious Windows drivers, explaining how the I/O manager wraps requests in I/O request packets (IRPs) that pass top-to-bottom through device stacks and their I/O stack locations. The post details how user-mode applications reach drivers via ReadFile and CreateFile, how drivers check MajorFunction and MinorFunction codes, and how requests are passed down with IoSkipCurrentIrpStackLocation and IoCallDriver and completed with IoCompleteRequest.
Bottom line: Kernel-level access through a malicious driver would let an attacker capture, initiate or alter network traffic and access or alter files on a system, and Virtual Secure Mode - the protection that can help defend against such drivers - is not enabled by default in a typical Windows environment.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026