GLCKIO2.sys
Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it
A known vulnerable driver
T1068Exploitation for Privilege Escalation
Its entrieshttps://www.loldrivers.io/drivers/52ded752-2708-499e-8f37-98e4a9adc23c/
https://www.loldrivers.io/drivers/868c6920-f6cb-4088-8277-095a1358abe1/
https://www.loldrivers.io/drivers/868c6920-f6cb-4088-8277-095a1358abe1/
3 known samples
3a5ec83fe670e5e23aef3afa0a7241053f5b6be5e6ca01766d6b5f9177183c2561a1bdddd3c512e681818debb5bee94db701768fc25e674fcad46592a3259bd0e5b0772be02e2bc807804874cf669e97aa36f5aff1f12fa0a631a3c7b4dd0dc8From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.
What detects it
Sigma names GLCKIO2.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.