CmdID / Files

Agent64.sys

DriverAgent Direct I/O for 64-bit Windows file version info

Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it

A known vulnerable driver

from LOLDrivers

T1068Exploitation for Privilege Escalation

Its entryhttps://www.loldrivers.io/drivers/5943b267-64f3-40d4-8669-354f23dec122/

6 known samples

6.0 · its entry

05f052c64d192cf69a462a5ec16dda0d43ca5d0245900c9fcb9201685a2e7748

6.0 · its entry

4045ae77859b1dbf13972451972eaaf6f3c97bea423e9e78f1c2f14330cd47ca

6.0 · its entry

4db1e0fdc9e6cefeb1d588668ea6161a977c372d841e7b87098cf90aa679abfb

6.0 · its entry

6948480954137987a0be626c24cf594390960242cd75f094cd6aaa5c2e7a54fa

6.0 · its entry

8cb62c5d41148de416014f80bd1fd033fd4d2bd504cb05b90eeb6992a382d58f

6.0 · its entry

b1d96233235a62dbb21b8dbe2d1ae333199669f67664b107bff1ad49b41d9414

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real Agent64.sys?

file version info and known copies

ProductDriverAgent, Phoenix Technologies

DescriptionDriverAgent Direct I/O for 64-bit Windows

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.

What detects it

Sigma

Sigma names Agent64.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.