directio64.sys
Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it
A known vulnerable driver
T1068Exploitation for Privilege Escalation
Its entrieshttps://www.loldrivers.io/drivers/a254e684-f6eb-40c4-a50a-7b76feb6cc02/
https://www.loldrivers.io/drivers/afed9dff-245e-4875-a156-3c5584beed03/
https://www.loldrivers.io/drivers/afed9dff-245e-4875-a156-3c5584beed03/
12 known samples
092349aebdac28294dbad1656759d8461f362d1a36b01054dccf861d97beadf00bc3685b0b8adc97931b5d31348da235cd7581a67edf6d79913e6a57098661354324f3d1e4007f6499a3d0f0102cd92ed9f554332bc0b633305cd7b957ff16c872c0d2d699d0440db17cb7cbbc06a253eaafd21465f14bb0fed8b85ae73153d179e87b93fbed84ec09261b3a0145c935f7dfe4d4805edfb563b2f971a0d514638939116df1d6c8fd0ebd14b2d37b3dec38a8820aa666ecd487bc1bb794f2a5879778136d2441439dc470861d15d96fa21dc9f16225232cd05b76791a5e0fde6fac63c26ca43701dddaa7fb1aea535d42190f88752900a03040fd5aaa24991e25b147a26dad59d9109710798b033ec3504a799f02e4356a358d6e32fdf7841b4ab2ba6efeff1860614b150916a77c9278f19d51e459e67a069ccd15f985cbc0e1bda99629ec6c522c3efcbcc9ca33688d31903146f05b37d0d3b43db81bfb3961d84e3e250a86227c64a96f6d5ac2b447674ba93d399160850acb2339da43eae5From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.
What detects it
Sigma names directio64.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.