WinRing0

Named by 2 kept items in this workspace.

1 items name it under classification.key entities and 1 under tools.

Search every workspace for WinRing0. It matches the name as written, so it can find other things that share it.

The items that name it 2

Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer
writeupas tools2026-10-08It is written here as WinRing0 (WinRing0x64.sys).
Legitimate but vulnerable kernel driver from OpenLibSys providing low-level hardware access; used by attackers to give the miner kernel-level hardware access rather than its typical use of disabling EDR.
Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity
writeupas classification.key entities2026-09-03

All technologies in this workspace.