CmdID

CmdID / Files

mhyprot3.sys

Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it

A known vulnerable driver

from LOLDrivers
T1068Exploitation for Privilege Escalation
Its entryhttps://www.loldrivers.io/drivers/2aa003cd-5f36-46a6-ae3d-f5afc2c8baa3/

6 known samples

its entry

24e70c87d58fa5771f02b9ddf0d8870cba6b26e35c6455a2c77f482e2080d3e9

its entry

475e5016c9c0f5a127896f9179a1b1577a67b357f399ab5a1e68aab07134729a

its entry

7fd90500b57f9ac959c87f713fe9ca59e669e6e1512f77fccb6a75cdc0dfee8e

its entry

b531f0a11ca481d5125c93c977325e135a04058019f939169ce3cdedaddd422d

its entry

b617a072c578cea38c460e2851f3d122ba1b7cfa1f5ee3e9f5927663ac37af61

its entry

c3d479d7efd0f6b502d6829b893711bdd51aac07d66326b41ef5451bafdfcb29

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

What detects it

Sigma

Sigma names mhyprot3.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.