CmdID / Files

GEDevDrv.SYS

GE Device Driver file version info

Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it

A known vulnerable driver

from LOLDrivers

T1068Exploitation for Privilege Escalation

Its entryhttps://www.loldrivers.io/drivers/e769d1f6-8a38-426f-b5e7-447241204ee1/

4 known samples

9.50 (Build 7677) · its entry

a369942ce8d4b70ebf664981e12c736ec980dbe5a74585dd826553c4723b1bce

9.50 (Build 7677) · its entry

ae73dd357e5950face9c956570088f334d18464cd49f00c56420e3d6ff47e8dc

7.00 (Build 5517) · its entry

51145a3fa8258aac106f65f34159d23c54b48b6d54ec0421748b3939ab6778eb

7.00 (Build 5517) · its entry

cac5dc7c3da69b682097144f12a816530091d4708ca432a7ce39f6abe6616461

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real GEDevDrv.SYS?

file version info and known copies

ProductProficy Machine Edition, GE Intelligent Platforms, Inc.

DescriptionGE Device Driver

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.

What detects it

Sigma

Sigma names GEDevDrv.SYS in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.