mhyprot.sys
Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it
A known vulnerable driver
T1068Exploitation for Privilege Escalation
2 known samples
0c512b615eac374d4d494e3c36838d8e788b3dc2691bf27916f7f42694b1446769e3fda487a5ec2ec0f67b7d79a5a836ff0036497b2d1aec514c67d2efa789b2From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.
What detects it
Sigma names mhyprot.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.