BS_I2cIo.sys

I/O Interface driver file file version info

Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it

A known vulnerable driver

from LOLDrivers

T1068Exploitation for Privilege Escalation

Its entrieshttps://www.loldrivers.io/drivers/66be9e0a-9246-4404-b5b5-7fbde351668f/
https://www.loldrivers.io/drivers/9e87b6b0-00ed-4259-bcd7-05e2c924d58c/
https://www.loldrivers.io/drivers/de4dd27a-1f7e-4271-98a4-55395ab6aabf/

3 known samples

1, 1, 0, 0 · its entry

42e170a7ab1d2c160d60abfc906872f9cfd0c2ee169ed76f6acb3f83b3eeefdb

1, 1, 0, 0 · its entry

55fee54c0d0d873724864dc0b2a10b38b7f40300ee9cae4d9baaf8a202c4049a

1, 1, 0, 0 · its entry

f929bead59e9424ab90427b379dcdd63fbfe0c4fb5e1792e3a1685541cd5ec65

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real BS_I2cIo.sys?

file version info and known copies

ProductBIOSTAR I/O driver fle, BIOSTAR Group

DescriptionI/O Interface driver file

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.

What detects it

Sigma

Sigma names BS_I2cIo.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.