amsdk.sys
WatchDog Antimalware Driver file version info
Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it
A known vulnerable driver
T1068Exploitation for Privilege Escalation
Its entrieshttps://www.loldrivers.io/drivers/981210cb-8b84-4d37-b46e-b71059b8c438/
https://www.loldrivers.io/drivers/a285591e-ad3c-46a3-a648-c58589ff5efc/
https://www.loldrivers.io/drivers/a285591e-ad3c-46a3-a648-c58589ff5efc/
2 known samples
3.0.0.000 · its entry
6f55c148bb27c14408cf0f16f344abcd63539174ac855e510a42d78cfaec451c1.0.600 · its entry
12b3d8bc5cc1ea6e2acd741d8a80f56cf2a0a7ebfa0998e3f0743fcf83fabb9eFrom LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.
Is it the real amsdk.sys?
Productamsdk, WatchDogDevelopment.com, LLC.
DescriptionWatchDog Antimalware Driver
From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.
What detects it
Sigma names amsdk.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.