DeathShotXD/0xCr0ssCrush

What it is

0xCr0ssCrush is a Windows BYOVD (bring your own vulnerable driver) research repo covering two signed drivers that the Cruciferra malware-as-a-service loader uses to kill AV/EDR processes before payload delivery. eSentire's Threat Response Unit documented the drivers on 2026-08-19. The repo does not claim to have discovered the vulnerabilities. Its contribution is a comparative, reproducible implementation, with detections, for both drivers.

How it works

Both drivers expose a user-mode-reachable process-termination primitive, and the repo's metadata classifies both as PROCESS_CONTROL / PROCESS_TERMINATION.

The Alinubx chain is PsLookupProcessByProcessId -> ObOpenObjectByPointer -> ZwTerminateProcess. DCRCVDrv acquires its handle via ZwOpenProcess or PsLookup, then follows the same last two steps. The operators fall back to the second driver if the host refuses the first, and the harness reproduces that behavior.

Preconditions / Affected

• At the time of research, neither file was in Microsoft's enforced vulnerable-driver blocklist. That snapshot is dated 2026-09-08 and is reproducible via docs/blocklist-status.md. Recheck it, because blocklist status changes.
• The test matrix is verified only on Windows 11 24H2 (build 26100) with HVCI disabled. Other builds are marked Not tested, Blocked or Unknown, and the repo makes no blanket compatibility claims.
• Loading a driver requires admin-level control of the host.

What to do

• Detection content: the repo ships a Sigma rule, a YARA rule and telemetry guidance:
• detection/sigma/driver_load_win_cruciferra_byovd.yml
• detection/yara/cruciferra_drivers.yar
• detection/telemetry/README.md
• Catalogs: cross-check against the LOLDrivers entries 89643454-e38b-41cb-853d-abf649a104a5 and 84a3007a-de5e-4622-bfc5-f05d927c3618 (added 2026-08-27).
• Lab reproduction: only on hosts you are authorized to test. The harness enforces hash validation before any driver load.

cargo build --release --target x86_64-pc-windows-gnu
crosscrush.exe -d -n "notepad.exe"        # dry run, no IOCTLs
crosscrush.exe -n "notepad.exe" -k dcrc   # single driver

• Provenance: metadata/samples.json holds per-sample hashes, so you can match them against your own telemetry.

Caveats

• Protected Process Light (PPL) targets were not terminable through these interfaces in testing.
• The repo separates "IOCTL accepted" from "process stopped", which are distinct observations.
• Alinubx exit-status propagation is [INFERRED], since the harness only sends 0.
• Device DACL behavior and some DCRCVDrv handle-source branches are [INFERRED] or [UNRESOLVED].
• Findings carry evidence labels (CONFIRMED, CORROBORATED, INFERRED, UNRESOLVED), so check each label before relying on a claim.