Windows Kernel Exploitation Framework

The Kernel Exploitation Framework, or KEF, is an advanced Windows offensive security tool developed by WebSec.

It provides authorized operators with Windows kernel-mode capabilities for privilege escalation, process and token manipulation, kernel callback management, ETW testing, WFP callout inspection, credential-protection testing, and other advanced security operations.

KEF is intended for authorized red team engagements, government operations, law enforcement, intelligence work, security research, and defensive control validation.

KEF is not publicly distributed or offered as unrestricted general-purpose software.

Access is limited to verified organizations with a legitimate operational requirement, including:

• Government security agencies
• Military cyber units
• Law enforcement organizations
• Intelligence teams
• Vetted red team providers
• Critical infrastructure security teams
• Approved cybersecurity research organizations

Prospective customers are subject to organizational verification, end-use review, applicable export-control screening, licensing requirements, and operator onboarding.

Ring0 is the processor privilege level commonly associated with kernel-mode execution on Windows. It is used by the Windows kernel and kernel-mode drivers and provides substantially more operating-system access than ordinary user-mode execution.

Ring0 does not mean absolute control over every system layer. Hypervisors and virtualization security components operate at a separate virtualization layer outside the guest operating system's normal ring model.

Within Windows, ring0 access allows KEF to inspect and interact with kernel callbacks, process protection levels, access tokens, minifilters, ETW components, WFP callouts, and protected process state.

Yes. KEF is designed to establish controlled Windows kernel-mode access and support escalation from guest or low-privileged contexts to SYSTEM during authorized operations.

The initial KEF access workflow does not rely on a conventional software exploit or a known vulnerable third-party driver.

Successful deployment depends on the supported Windows environment and applicable device, driver, network, and endpoint policies.

No. KEF does not rely on a zero-day vulnerability, a publicly known vulnerable driver, or a conventional vulnerable-driver exploit to establish its privileged context.

KEF uses a purpose-built kernel-mode driver as part of its hardware-assisted workflow. The driver does not depend on a published vulnerability in KEF or in a third-party driver.

Additional technical information can be provided to approved customers during onboarding.

No. The KEF driver is not included in the Microsoft Vulnerable Driver Blocklist and KEF does not rely on a known vulnerable third-party driver.

KEF uses a purpose-built kernel-mode driver to establish the privileged context required for authorized kernel-level operations. The use of a kernel-mode driver does not mean that the driver itself is vulnerable.

The KEF hardware component is a compact USB operator device that provides controlled access to the tool.

The device remains inactive by default. Before it can be used, the operator must enter a valid activation key generated through the KEF Client Web Interface.

Each activation key enables the device for up to 24 hours. After that period expires, a new activation key is required. Key generation remains available while the customer's WebSec subscription is active and authorized.

The standard KEF hardware workflow requires:

• An internet connection for authentication and subscription validation
• Windows policies that permit the required third-party driver workflow
• Windows Update and relevant trust services to remain available
• Device-control and application-control policies that allow the required hardware and driver components

These conditions are present by default in many supported Windows environments, including secured enterprise networks.

KEF should not be described as universally undetectable.

In WebSec testing, the initial driver invocation did not produce a useful conventional logging artifact for ordinary SOC monitoring. Individual KEF capabilities may still generate detections depending on the selected action, endpoint security product, configured policies, available telemetry, and detection rules.

This makes KEF suitable for evaluating both security-control resilience and defensive visibility.

KEF includes a broad and continuously expanding set of Windows kernel-level capabilities. To name a few:

• Ring0 access and privilege escalation
• Process and access-token control
• PPL and integrity-level modification
• Kernel callback and minifilter management
• ETW provider inspection and control
• WFP callout inspection and testing
• User-mode hook removal
• Controlled LSASS memory acquisition
• Kernel-assisted DLL injection
• Security-state inspection and restoration workflows

This is not an exhaustive list of KEF's capabilities. WebSec is actively developing the tool and continuously adding new and novel tactics, techniques, and supporting modules based on Windows internals research, real-world red team requirements, and defensive control validation.

KEF supports both a graphical interface and a terminal-based TUI/CLI mode. It also records supported operator actions and timestamps, allowing red teams and detection engineers to correlate activity with alerts, missed detections, and defensive telemetry.