CITMDRV_AMD64.sys
Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it
A known vulnerable driver
T1068Exploitation for Privilege Escalation
16 known samples
Show the 16 samples’ SHA-256 hashes
29e0062a017a93b2f2f5207a608a96df4d554c5de976bd0276c2590a03bd3e9445abdbcd4c0916b7d9faaf1cd08543a3a5178871074628e0126a6eda890d26e050db5480d0392a7dd6ab5df98389dc24d1ed1e9c98c9c35964b19dabcd6dc67f607dc4c75ac7aef82ae0616a453866b3b358c6cf5c8f9d29e4d37f844306b97c61d6e40601fa368800980801a662a5b3b36e3c23296e8ae1c85726a56ef18cc874a846c61adc53692d3040aff4c1916f32987ad72b07fe226e9e7dbeff1036c476fb4deaee57ef30e56c382c92abffe2cf616d08dbecb3368c8ee6b02e59f30381939e5c12bd627ff268e9887d6fb57e95e6049f28921f3437898757e7f214699790a7b9d624b2b18768bb655dda4a05a9929633cef0b1521e79e40d7de0a05b9a1d66036b0868bbb1b2823209fedea61a301d5dd245f8e7d390bd31e52d663eaa9ab1195dc866270e984f1bed5e1358d6ef24c515dfdb6c2a92d1e1b94bf608af095de15a16255ca1b2c27dad365dff9ac32d2a75e8e288f5a1307680781685d5586dc1e61796a9ae5e5d1ced397874753056c3df2eb963a8916287e1929a71d8459f7d707c635e2c04d6d6d47b63f73ba3f6629702c7a6e0df0462f6478ae2e81230217988f3e7ec6f89a06d231ec66039bdba340fd8ebb2bbb586506e3293f88ebb633406a086d9cca6bc8b66a4ea940c5476529f9033a9e0463512a23a57From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.
What detects it
Sigma names CITMDRV_AMD64.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.