AMDPowerProfiler.sys
AMD Power Profiling Driver file version info
Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it
A known vulnerable driver
T1068Exploitation for Privilege Escalation
3 known samples
6.1.0.0 · its entry
0af5ccb3d33a9ba92071c9637be6254030d61998733a5eb3583e865e17844e056.0.0.0 · its entry
1e6f08a686be2e28469b2d71d8567f2023ddbd65bd65618fc7bbac16d39e04d56.0.0.0 · its entry
5f7bf4e385cd44014f389058411374172ecd79d9066abcbbbc59dd84f89b85fbFrom LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.
Is it the real AMDPowerProfiler.sys?
ProductAMD uProf, Advanced Micro Devices, Inc.
DescriptionAMD Power Profiling Driver
From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.
What detects it
Sigma names AMDPowerProfiler.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.