Safetica Driver Flaw Enables Arbitrary Process Termination

A flaw in Safetica’s ProcessMonitorDriver.sys kernel driver lets an unprivileged user abuse an IOCTL interface to terminate arbitrary system processes. This can enable denial-of-service and the disruption of security tools on affected endpoints. The issue can be abused to kill EDR agents and other critical services, reducing defensive coverage quickly. No vendor patch is currently available.

The report documents CVE-2026-0828 in ProcessMonitorDriver.sys across Safetica DLP client versions. It shows that weak input validation allows process termination to occur with elevated driver privileges via crafted IOCTL calls. The impact on endpoint security monitoring is emphasized.

Monitor for suspicious IOCTL calls to the driver, rely on EDR or host telemetry, and restrict driver access using Windows Group Policy, WDAC, or AppLocker. Until a fix is released, block untrusted binaries from interacting with ProcessMonitorDriver.sys.

Detect abnormal IOCTL activity targeting ProcessMonitorDriver.sys, isolate affected systems, and apply policy controls to deny driver access. Increase logging, alert on unprivileged interactions, and consider disabling the driver as a temporary workaround.

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

Attack Narrative & Commands: The red‑team operator aims to abuse the vulnerable ProcessMonitorDriver.sys driver to terminate an arbitrary high‑privilege process ( lsass.exe ). They achieve this by crafting a malicious IOCTL payload that instructs the driver to close the target PID’s handle, thereby hijacking execution flow (T1574) and evading typical defense mechanisms (T1211). The steps are:

Regression Test Script:

Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.