echo_driver.sys
Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it
A known vulnerable driver
T1134Access Token Manipulation
2 known samples
a41e9bb037cf1dc2237659b1158f0ed4e49b752b2f9dae4cc310933a9d1f1e47ea3c5569405ed02ec24298534a983bcb5de113c18bc3fd01a4dd0b5839cd17b9From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.
What detects it
Sigma names echo_driver.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.