xhunter1_privesc (Ab)using the XIGNCODE3 driver to open a handle to any process. Link to writeup here.