Bs_Def64.sys

Default BIOS Flash Driver file version info

Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it

A known vulnerable driver

from LOLDrivers

T1068Exploitation for Privilege Escalation

Its entrieshttps://www.loldrivers.io/drivers/3ac0eda2-a844-4a9d-9cfa-c25a9e05d678/
https://www.loldrivers.io/drivers/4a80da66-f8f1-4af9-ba56-696cfe6c1e10/

4 known samples

1.24 built by: WinDDK · its entry

0040153302b88bee27eb4f1eca6855039e1a057370f5e8c615724fa5215bada3

1.24 built by: WinDDK · its entry

3326e2d32bbabd69feb6024809afc56c7e39241ebe70a53728c77e80995422a5

1.24 built by: WinDDK · its entry

36b9e31240ab0341873c7092b63e2e0f2cab2962ebf9b25271c3a1216b7669eb

1.24 built by: WinDDK · its entry

5f5e5f1c93d961985624768b7c676d488c7c7c1d4c043f6fc1ea1904fefb75be

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real Bs_Def64.sys?

file version info and known copies

ProductSupport SST39SF020,SST29EE020,AT49F002T,AT29C020,AM29F002NT,AM29F002NB,V29C51002T,V29C51002B,M29F002T,W29C020., AsusTek Computer Inc.

DescriptionDefault BIOS Flash Driver

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.

What detects it

Sigma

Sigma names Bs_Def64.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.