A kernel-mode driver component that can be used by an attacker to take control of an OS without alerting security mechanisms.

A kernel-mode driver component that can be used by an attacker to take control of an OS without alerting security mechanisms.

• A. Necurs
• B. Scranos
• C. Horse Pill
• D. LoJax

Answer: (A)

Kernel-mode drivers run with the highest privileges inside the operating system, giving them direct access to core OS functions and the ability to intercept or modify system behavior. An attacker who uses a kernel-mode driver can take control of the OS, hide malicious activity from security tools, and maintain persistence without triggering alerts. Necurs has been associated with loading a kernel-mode driver as part of its operation, enabling the attacker to exercise control at a deep level while evading detection. This aligns exactly with the description of a kernel-mode driver component used to seize control without alerting security mechanisms. LoJax, by contrast, is known for firmware/UEFI rootkit techniques—persistence outside the normal OS kernel space—so it isn’t described as a kernel-mode driver component. Scranos and Horse Pill involve various stealth capabilities as well, but the scenario centers on a kernel-mode driver within the OS, which Necurs exemplifies.

Kernel-mode drivers run with the highest privileges inside the operating system, giving them direct access to core OS functions and the ability to intercept or modify system behavior. An attacker who uses a kernel-mode driver can take control of the OS, hide malicious activity from security tools, and maintain persistence without triggering alerts.

Necurs has been associated with loading a kernel-mode driver as part of its operation, enabling the attacker to exercise control at a deep level while evading detection. This aligns exactly with the description of a kernel-mode driver component used to seize control without alerting security mechanisms.

LoJax, by contrast, is known for firmware/UEFI rootkit techniques—persistence outside the normal OS kernel space—so it isn’t described as a kernel-mode driver component. Scranos and Horse Pill involve various stealth capabilities as well, but the scenario centers on a kernel-mode driver within the OS, which Necurs exemplifies.