GameTerSafe.sys
Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it
A known vulnerable driver
T1068Exploitation for Privilege Escalation
Its entrieshttps://www.loldrivers.io/drivers/067589f2-4f29-4dc4-bd50-a2e2ee57b25f/
https://www.loldrivers.io/drivers/1ab1ec8c-1231-4ba4-8804-4a2cda103bb8/
https://www.loldrivers.io/drivers/1ab1ec8c-1231-4ba4-8804-4a2cda103bb8/
1 known sample
e2ec3b2a93c473d88bfdf2deb1969d15ab61737acc1ee8e08234bc5513ee87eaFrom LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.
What detects it
Sigma names GameTerSafe.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.