One Day Sec

How can an attacker trigger a BSOD by terminating a specific, non‑current process?

The attacker first elevates privileges to obtain `Debug` privilege, then uses `OpenProcess` to get a handle to the target process. They call `NtSetInformationProcess` on that handle with `ProcessBreakOnTermination` set to `TRUE`, marking the target process as critical. When the target process terminates (e.g., by the attacker or normally), the system triggers a BSOD. Full code examples are referenced in the original Analysis of Exploitation Techniques for Triggering BSOD by Terminating Processes.
OpenProcessDebug privilegeNtSetInformationProcessprocess handlecritical process

Browse all Q&A →