eneio64.sys
Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it
A known vulnerable driver
T1068Exploitation for Privilege Escalation
Its entrieshttps://www.loldrivers.io/drivers/90ecbbf7-b02f-424d-8b7d-56cc9e3b5873/
https://www.loldrivers.io/drivers/9b65dba4-81a0-48cc-8ff0-a4f353881062/
https://www.loldrivers.io/drivers/9b65dba4-81a0-48cc-8ff0-a4f353881062/
2 known samples
38c18db050b0b2b07f657c03db1c9595febae0319c746c3eede677e21cd238b09ee33ffd80611a13779df6286c1e04d3c151f1e2f65e3d664a08997fcd098ef3From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.
What detects it
Sigma names eneio64.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.