CmdID

CmdID / Files

capcom.sys

Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it

A known vulnerable driver

from LOLDrivers
T1068Exploitation for Privilege Escalation
Its entryhttps://www.loldrivers.io/drivers/b51c441a-12c7-407d-9517-559cc0030cf6/

7 known samples

its entry

2a11b4f125d8537e69af7b684494e49ef2a30a219634988e278177fa36c934eb

its entry

2b188ae51ec3be082e4d08f7483777ec5e66d30e393a4e9b5b9dc9af93d1f09b

its entry

54488a8c7da53222f25b6ed74b0dedc55d00f5fa80f4eaf6daac28f7c3528876

its entry

ac26150bc98ee0419a8b23e4cda3566e0eba94718ba8059346a9696401e9793d

its entry

c2562e0101cb39906c73b96fc15a6e6e3edd710b19858f6bbd0c90f1561b6038

its entry

d9e8be11a19699903016f39f95c9c5bf1a39774ecea73670f2c3ed5385ebfe4c

its entry

da6ca1fb539f825ca0f012ed6976baf57ef9c70143b7a1e88b4650bf7a925e24

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

What detects it

Sigma

Sigma names capcom.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.