CmdID / Files

EIO.sys

ASUS VGA Kernel Mode Driver file version info

Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it

A known vulnerable driver

from LOLDrivers

T1068Exploitation for Privilege Escalation

Its entryhttps://www.loldrivers.io/drivers/f654ad84-c61d-477c-a0b2-d153b927dfcc/

4 known samples

1.97 · its entry

1fac3fab8ea2137a7e81a26de121187bf72e7d16ffa3e9aec3886e2376d3c718

1.97 · its entry

cf69704755ec2643dfd245ae1d4e15d77f306aeb1a576ffa159453de1a7345cb

1.97 · its entry

f4c7e94a7c2e49b130671b573a9e4ff4527a777978f371c659c3f97c14d126de

1.96 · its entry

b17507a3246020fa0052a172485d7b3567e0161747927f2edf27c40e310852e0

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real EIO.sys?

file version info and known copies

ProductASUS VGA Kernel Mode Driver, ASUSTeK Computer Inc.

DescriptionASUS VGA Kernel Mode Driver

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.

What detects it

Sigma

Sigma names EIO.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.