[WHQL]利用CVE-2025-52915漏洞自动终止360进程

ANY.LNK

嗯，几个月前见过类似的东西（用同一漏洞的PoC）

https://bbs.kafan.cn/thread-2284924-1-1.html

lingchenheiye

没加密？

superLYT

BDTS驱动解压后报毒

谈谈MEMZ

1. Application Information:
   
2. Source process ID: 6356
   
3. Source process name: cmd.exe
   
4. Source application location: C:\Windows\System32\cmd.exe
   
5. Source process command line: "C:\Windows\System32\cmd.exe" /C "C:\Users\User\Desktop\C\[打开我]LoadDriver.bat"
   
6. Source application version: 10.0.20348.2849 (WinBuild.160101.0800)
   
7. Source application publisher: Microsoft Corporation
   
8. Source application signers: Microsoft Corporation,Microsoft Corporation,Microsoft Corporation,Microsoft Corporation
   
9. Source process user name: N/A\User
   
10. 
    
11. 
    
12. Prevention Information:
    
13. Prevention date: 2026年2月22日
    
14. Prevention time: 23:09:13
    
15. OS version: 10.0.20348
    
16. Component: Behavioral Threat Protection
    
17. Cortex XDR code: C0400067
    
18. Prevention description: 检测到恶意行为
    
19. Verdict: 0
    
20. Quarantined: False
    
21. Post-Detected: False
    
22. Rule name: sync.suspicious_driver_service_creation.1
    
23. Remote actor causality ID: AdykDTCfyM4AABjUAAAAAA==
    

复制代码

1. Application Information:
   
2. Source process ID: 4
   
3. Source process name: System
   
4. Source application location: System
   
5. Source process command line:
   
6. Source application version:
   
7. Source application publisher:
   
8. Source application signers: Microsoft Corporation,Microsoft Corporation,Microsoft Corporation,Microsoft Corporation
   
9. Source process user name: N/A\SYSTEM
   
10. 
    
11. 
    
12. Prevention Information:
    
13. Prevention date: 2026年2月22日
    
14. Prevention time: 23:09:14
    
15. OS version: 10.0.20348
    
16. Component: Behavioral Threat Protection
    
17. Cortex XDR code: C0400067
    
18. Prevention description: 检测到恶意行为
    
19. Verdict: 0
    
20. Quarantined: False
    
21. Post-Detected: False
    
22. Rule name: sync.vulnerable_driver_by_original_name_loaded_k7rkscan.sys
    
23. Remote actor causality ID: AdykDPorWkkAAAAEAAAAAA==

复制代码