Chaos-Rootkit.sys
Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it
A known vulnerable driver
T1068Exploitation for Privilege Escalation
Its entrieshttps://www.loldrivers.io/drivers/abcd2c10-1078-4cf9-b320-04ca38d22f98/
https://www.loldrivers.io/drivers/de62baae-872d-4e9a-b6d9-b0ac99854c66/
https://www.loldrivers.io/drivers/de62baae-872d-4e9a-b6d9-b0ac99854c66/
2 known samples
0ae8d1dd56a8a000ced74a627052933d2e9bff31d251de185b3c0c5fc94a44dbbdc73f752c1353d41e877d8bf42a1c53f0bba7d6f52348aaef60e06f4d3087d0From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.
What detects it
Sigma names Chaos-Rootkit.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.