Mhyprot2.sys
Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it
A known vulnerable driver
T1068Exploitation for Privilege Escalation
8 known samples
247aadaf17ed894fcacf3fc4e109b005540e3659fd0249190eb33725d3d3082f26d69e677d30bb53c7ac7f3fce76291fe2c44720ef17ee386f95f08ec5175288342cf884840fc2b48c96398f690a1801ed8ac1ea59305af9e3d070d13ef8560146cf46e1073b7c99142964b7c4bef1e5285fabcf2c6dbe5be99000a393d9f474509628b6d16d2428031311d7bd2add8d5f5160e9ecc0cd909f1e82bbbb3234d66e76764d750ebd835aa4bb055830d278df530303585614c1dc743f8d5adf97d7ad2477632b9b07588cfe0e692f244c05fa4202975c1fe91dd3b90fa911ac6058b8b94c2646b62f6ac08f16514b6efaa9866aa3c581e4c0435a7aeafe569b2418From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.
What detects it
Sigma names Mhyprot2.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.