FPCIE2COM.sys
Fintek Pcie2Uart Adapter file version info
Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it
A known vulnerable driver
6 known samples
22,12,5,0 · its entry
81fbc9d02ef9e05602ea9c0804d423043d0ea5a06393c7ece3be03459f76a41d22,12,5,0 · its entry
ebf0e56a1941e3a6583aab4a735f1b04d4750228c18666925945ed9d7c9007e117.9.27.1 · its entry
faa7aaec1df5ef6b43d45a9f465a09c3a7fd0264f1e77415a63f9d1ea3dfaa341, 0, 0, 0 · its entry
17942865680bd3d6e6633c90cc4bd692ae0951a8589dbe103c1e293b3067344d1, 0, 0, 0 · its entry
32bd0edb9daa60175b1dc054f30e28e8dbfa293a32e6c86bfd06bc046eaa2f9e1, 0, 0, 0 · its entry
b1920889466cd5054e3ab6433a618e76c6671c3e806af8b3084c77c0e7648cbeFrom LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.
Is it the real FPCIE2COM.sys?
From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.
What detects it
Sigma names FPCIE2COM.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.