amp.sys

amp.sys is a generic filename that more than one signed driver has used, so identification matters here. The driver catalogued on the public LOLDrivers list is the CYREN AMP file-system filter, an anti-malware scanning component signed by Commtouch (later branded CYREN) and embedded in OEM security products. It is a 2014-era signed driver that still loads on modern Windows.

A separate, unrelated driver also named AMP.sys ships with iolo System Mechanic, a consumer PC-tuneup product, and has its own publicly posted privilege-escalation proof-of-concept. They are different files from different vendors that happen to share a name. Neither has an assigned CVE, and the LOLDrivers entry rests on the signed-driver capability, not a reported incident.

Because the name is shared, the practical step is to work out which software actually placed the file. If you run an OEM security suite or iolo System Mechanic, that is the likely source; update or remove it. Microsoft's Vulnerable Driver Blocklist blocks known-bad builds from loading.

amp.sys is listed as a known-vulnerable driver on the public LOLDrivers project. One distinct binary hash matching this filename is on record.