CmdID / Files

elrawdsk.sys

RawDisk Driver. Allows write access to files and raw disk sectors for user mode applications in Windows 2000 and later. file version info

Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it

A known vulnerable driver

from LOLDrivers

T1068Exploitation for Privilege Escalation

Its entryhttps://www.loldrivers.io/drivers/205721b7-b83b-414a-b4b5-8bacb4a37777/

2 known samples

2, 1, 27, 106 · its entry

4744df6ac02ff0a3f9ad0bf47b15854bbebb73c936dd02f7c79293a2828406f6

2, 1, 27, 106 · its entry

5a826b4fa10891cf63aae832fc645ce680a483b915c608ca26cedbb173b1b80a

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real elrawdsk.sys?

file version info and known copies

ProductRawDisk, EldoS Corporation

DescriptionRawDisk Driver. Allows write access to files and raw disk sectors for user mode applications in Windows 2000 and later.

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.

What detects it

Sigma

Sigma names elrawdsk.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.