DirectIo32.sys
Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it
A known vulnerable driver
T1068Exploitation for Privilege Escalation
Its entrieshttps://www.loldrivers.io/drivers/7a0842ca-1a64-4ad1-9d66-25eb983d1742/
https://www.loldrivers.io/drivers/ee2d68aa-1a65-4967-8627-73590b041538/
https://www.loldrivers.io/drivers/ee2d68aa-1a65-4967-8627-73590b041538/
8 known samples
0be4912bfd7a79f6ebfa1c06a59f0fb402bd4fe0158265780509edd0e562eac138b3eb8c86201d26353aab625cea672e60c2f66ce6f5e5eda673e8c3478bf3053f9530c94b689f39cc83377d76979d443275012e022782a600dcb5cad4cca6aa65025741ecd0ef516da01319b42c2d96e13cb8d78de53fb7e39cd53ea6d58c7572288d4978ee87ea6c8b1566dbd906107357087cef7364fb3dd1e1896d00baeb7dfc2eb033d2e090540860b8853036f40736d02bd22099ff6cf665a90be659cde3b257357be41a18319332df7023c4407e2b93ac4c9e0c6754032e29f3763eace4c154a0073bbad3c9f8ab7218e9b3be252ae705c20c568861dae4088f17ffccFrom LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.
What detects it
Sigma names DirectIo32.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.