bedaisy.sys
Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it
A known vulnerable driver
T1068Exploitation for Privilege Escalation
34 known samples
Show the 34 samples’ SHA-256 hashes
0a9b608461d55815e99700607a52fbdb7d598f968126d38e10cc4293ac4b1ad80bd164da36bd637bb76ca66602d732af912bd9299cb3d520d26db528cb54826d2b120de80a5462f8395cfb7153c86dfd44f29f0776ea156ec4a34fa64e5c47973b19a7207a55d752db1b366b1dea2fd2c7620a825a3f0dcffca10af76611118c3d8cfc9abea6d83dfea6da03260ff81be3b7b304321274f696ff0fdb9920c6454ba224af60a50cad10d0091c89134c72fc021da8d34a6f25c4827184dc6ca5c75d7bfe05792189eaf7193bee85f0c792c33315cfcb40b2e62cc7baef6cafbc5c7108613244f16c2279c3c917aa49cef8acf0b92fdaa9ace19bf5cf634360d727773999db2f07c50aad70e50c1983fa95804369d25a5b4f10bd610f864c27f2fc7c830ed39c9de8fe711632bf44846615f84b10db383f47b7d7c9db29a2bd829a854bc946b557ed78c7d40547eb39e293e83942a693c94d0e798d1c4fbde7efa98ae383546761069b26826dfbf2ac0233169d155bca6a94160488092b4e70b2228bf01cd6d55502838853851703eb297ec71361fa9a0b088a30c2434f4d2bf9c69bd8b0289955a6eb791f45c3203f08a64cbd457fd1b9d598a6fbbca5d0372e369e2622d8e7a0ec136ba1fff639833f05137f8a1ff03e7a93b9a4aea25e7abb8da0e583bd88eb198558442f69a8bbfc96f4c5c297befea295138cfd2070f745c5a19fc837ca342d2db43ee8ad7290df48a1b8b85996c58a19ca3530101862a804af298d940b186f922464d2ef19ccfc129c77126a4f337ecf357b4fe5162a477cb7bba82777c9912e6a728c3e873c5a8fd3546982e0d5fa88e64b3e2122f9bc3bb9ed73af3aef69dc1fb91731d6d0a649e93f83d0f07ddb9729d71c2d00ed0801bceaf970b60b4457eca3c181f649a1c67f4602778171e53d9bdc9b97a09603cac0ae3349ebaac9a99c47ec55d5f7de00dc03bd7c5cd15799bc00646d642aa8dec35f3a9da8e81e75642af20103240618b641d39724f9df438bf0f361122876b0c640930c29ea3610a3a5cebee573235ec70267ed223b79b9fa45a80081e686a4c8ff7c9f510f7a2ed88d9b336d8c9339698d5e1ee14bfb91aa89703ec06dce42cf66fcbcb8b2ea7fb4398f398b7480c50f6a451b51367718c36330182c1bb496d2e843d9729da9b19d6085edf69b90b057c890a74142f5202707057ee9c0b568dbebf6d463c2dbf61836b3eba09b643e1d79a02652a32482ca58894703b9addbe89afd283d5789b8064d5487e04b97e2cd3fc0c711a8cec230543ebdf9ffc534eba14a2b4cefd74edaf38d963775352dc3618977e30261aab52be682a76b536fedfc38f91b5e198f3bf80ef6dcaebb5e86963936bcd2e5280088ca90d6998b8cf2ed6c1906663016123559d9f3407bc67f64e0d235fa6f10810a3fa7bb322967fa21e3d2bfb9fafddec0488852377fbb2dbdd6c066ca05bb5c4b6aa840fb7879ffd03584246730397e231eb8d16c1449aef2c3bc79bf9da3ebf8400a21b20ae7From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.
What detects it
Sigma names bedaisy.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.