DirectIo.sys
Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it
A known vulnerable driver
T1068Exploitation for Privilege Escalation
Its entrieshttps://www.loldrivers.io/drivers/62e2a967-1f03-4225-a325-122b109208f3/
https://www.loldrivers.io/drivers/a2c3f6e9-25a5-4b75-8c6b-ad2d4e155822/
https://www.loldrivers.io/drivers/ce2d41fd-908f-414c-b6b5-338298f425b8/
https://www.loldrivers.io/drivers/a2c3f6e9-25a5-4b75-8c6b-ad2d4e155822/
https://www.loldrivers.io/drivers/ce2d41fd-908f-414c-b6b5-338298f425b8/
8 known samples
2b186926ed815d87eaf72759a69095a11274f5d13c33b8cc2b8700a1f020be1d31f4140c12ac31f5729a8de4dc051d3acd07783564604df831a2a6722c9791924422851a0a102f654e95d3b79c357ae3af1b096d7d1576663c027cfbc04abaf9673b63b67345773cd6d66f6adcf2c753e2d949232bff818d5bb6e05786538d9283f7be0a13c1fccf024c31da5c68c0ea1decf4f48fc39d6e4fd324bbe789ae8a94be67c319a67de75ebed050d5537cfaa795d72bba52f3d8cf349e7bd075410ebb68552936a6b0a68fb53ce864a6387d2698332aac10a7adfdd5a48b97027ce3e6a7a497010579fde69cd52bed8de28db610c33bbc5ce0774459dcf64657b802From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.
What detects it
Sigma names DirectIo.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.