ATSZIO.sys
ATSZIO Driver file version info
Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it
A known vulnerable driver
https://www.loldrivers.io/drivers/6ec5ddda-f302-4008-a73e-12814c1d571f/
10 known samples
0, 2, 1, 2 · its entry
31d8fc6f5fb837d5eb29db828d13ba8ee11867d86a90b2c2483a578e1d0ec43a0, 2, 1, 2 · its entry
673bcec3d53fab5efd6e3bac25ac9d6cc51f6bbdf8336e38aade2713dc1ae11b0.2.2.3 · its entry
fb6b0d304433bf88cc7d57728683dbb4b9833459dc33528918ead09b3907ff220.2.1.7 · its entry
01e024cb14b34b6d525c642a710bfa14497ea20fd287c39ba404b10a8b143ece0.2.1.7 · its entry
0da746e49fd662be910d0e366934a7e02898714eaaa577e261ab40eb44222b5c0.2.1.7 · its entry
1a4f7d7926efc3e3488758ce318246ea78a061bde759ec6c906ff005dd8213e50.2.1.7 · its entry
e32ab30d01dcff6418544d93f99ae812d2ce6396e809686620547bea05074f6f0.2.1.7 · its entry
ecfc52a22e4a41bf53865b0e28309411c60af34a44e31a5c53cdc8c5733e82820.2.1.6 · its entry
55a1535e173c998fbbc978009b02d36ca0c737340d84ac2a8da73dfc2f450ef90.2.1.6 · its entry
c64d4ac416363c7a1aa828929544d1c1d78cf032b39769943b851cfc4c0faafcFrom LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.
Is it the real ATSZIO.sys?
From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.
What detects it
Sigma names ATSZIO.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.