{
  "driverModel": "wdm",
  "relatedDDIs": [
    "ExRegisterExtension",
    "ExTryQueueWorkItem",
    "ExUnregisterExtension",
    "FsRtlMdlRead",
    "FsRtlMdlReadComplete",
    "IoAllocateMiniCompletionPacket",
    "IoFreeMiniCompletionPacket",
    "IoInitializeMiniCompletionPacket",
    "Ke386GetGdtEntryThread",
    "Ke386IoSetAccessProcess",
    "Ke386QueryIoAccessMap",
    "Ke386SetDescriptorProcess",
    "Ke386SetIoAccessMap",
    "Ke386SetLdtProcess",
    "Ke386SetVdmInterruptHandler",
    "KeAddSystemServiceTable",
    "KeIsAttachedProcess",
    "KeRemoveSystemServiceTable",
    "KeUserModeCallback",
    "Ki386DispatchOpcode",
    "Ki386DispatchOpcodeV86",
    "Ki386GetSelectorParameters",
    "KiEditIopmDpc",
    "MmAdjustWorkingSetSize",
    "MmCopyVirtualMemory",
    "MmCreateSection",
    "MmMapMemoryDumpMdl",
    "MmMapViewOfSection",
    "MmSetBankedSection",
    "MmUnmapViewOfSection",
    "ObIsDosDeviceLocallyMapped",
    "PoDisableSleepStates",
    "PoLatencySensitivityHint",
    "PoReenableSleepStates",
    "PoRequestShutdownEvent",
    "PoUserShutdownCancelled",
    "PoUserShutdownInitiated",
    "PsAcquireProcessExitSynchronization",
    "PsGetCurrentProcessSessionId",
    "PsGetCurrentThreadPreviousMode",
    "PsGetCurrentThreadStackBase",
    "PsGetCurrentThreadStackLimit",
    "PsGetJobLock",
    "PsGetJobSessionId",
    "PsGetJobUIRestrictionsClass",
    "PsGetProcessSecurityPort",
    "PsIsSystemProcess",
    "PsIsThreadImpersonating",
    "PsReferenceProcessFilePointer",
    "PsReleaseProcessExitSynchronization",
    "PsResumeProcess",
    "PsResumeThread",
    "PsSetLdtEntries",
    "PsSetProcessLdtInfo",
    "PsSetProcessPriorityByClass",
    "PsSetProcessPriorityClass",
    "PsSetProcessSecurityPort",
    "PsSetProcessWin32Process",
    "PsSetProcessWindowStation",
    "PsSetThreadHardErrorsAreDisabled",
    "PsSetThreadWin32Thread",
    "PsSuspendProcess",
    "PsSuspendThread",
    "PsTerminateProcess",
    "SeAuditingWithTokenForSubcategory",
    "SeCreateAccessState",
    "SeCreateAccessStateEx",
    "SeDeleteAccessState",
    "SeTokenImpersonationLevel"
  ],
  "ruleName": "UsingNtosP"
}