cg6kwin2k.sys
CG/MG family driver file version info
Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it
A known vulnerable driver
T1068Exploitation for Privilege Escalation
2 known samples
2.00 built by: Administrator · its entry
223f61c3f443c5047d1aeb905b0551005a426f084b7a50384905e7e4ecb761a12.00 built by: Administrator · its entry
e054f61bb54672b374c6ac0f5d8176407ba43d397bc624ec40e281909724e6c7From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.
Is it the real cg6kwin2k.sys?
ProductCT Access, NMS Communications
DescriptionCG/MG family driver
From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.
What detects it
Sigma names cg6kwin2k.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.