LenovoDiagnosticsDriver.sys
Lenovo Diagnostics Driver for Windows 10 and later. file version info
Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it
A known vulnerable driver
4 known samples
1,00,02,0 · its entry
279cf7f22d08724fa346b8138a35cda22ff4bb7a6d19d2d44e8905b0e9634dfd1,0,3,0 · its entry
93cb6b6879fc9fd71b9539265ec3d5d1969cc00cfe2758979a03d7c19cdc0e201.0.4.0 · its entry
b4dddea3fed5881aadcc8cce86eb2a50b613b6041bc63477fee4a8e6b0db65f11.0.4.0 · its entry
f05b1ee9e2f6ab704b8919d5071becbce6f9d0f9d0ba32a460c41d5272134abeFrom LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.
Is it the real LenovoDiagnosticsDriver.sys?
From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.
What detects it
Sigma names LenovoDiagnosticsDriver.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.