dellbios.sys
Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it
A known vulnerable driver
T1068Exploitation for Privilege Escalation
11 known samples
0584520b4b3bdad1d177329bd9952c0589b2a99eb9676cb324d1fce46dad0b9a163912dfa4ad141e689e1625e994ab7c1f335410ebff0ade86bda3b7cdf6e0652288c418ddadd5a1db4e58c118d8455b01fd33728664408ce23b9346ae0ca0573678ba63d62efd3b706d1b661d631ded801485c08b5eb9a3ef38380c6cff319a5449e4dd1b75a7d52922c30baeca0ca8e32fe2210d1e72af2a2f314a5c2268fb5bf3985644308662ebfa2fbcc11fb4d3e2a0c817ad3da1a791020f8c8589ebc86575ea9b319beb3845d43ce2c70ea55f0414da2055fa82eec324c4cebdefe893700b9839fde53e91f0847053b4d2eb8d9bd3aca098844510f1fa3bab6a37eb24a6c11d3bec2a94c40933ec1d3604cfe87617ba828b14f4cded6cfe85656debc0b3a191ccd1df19cdf17fe6637d48266ac84c4310b013ad6973d8cb336b06ff69b84dc9b885193ced6a1b6842a365a4f18d1683951bb11a5c780ab737ffa06684From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.
What detects it
Sigma names dellbios.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.