MsIo32.sys

MICSYS IO driver file version info

Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it

A known vulnerable driver

from LOLDrivers

T1068Exploitation for Privilege Escalation

Its entrieshttps://www.loldrivers.io/drivers/214654eb-90c4-48c8-a183-0157e50bf07f/
https://www.loldrivers.io/drivers/4e5064b4-48d3-418c-a7a8-f0dc7ac0a176/
https://www.loldrivers.io/drivers/58509acb-50b4-41a0-9de3-76c571a459e3/

3 known samples

its entry

2270a8144dabaf159c2888519b11b61e5e13acdaa997820c09798137bded3dd6

its entry

525d9b51a80ca0cd4c5889a96f857e73f3a80da1ffbae59851e0f51bdfb0b6cd

its entry

c7d4943ddac34e1a38692c624d799e634ad4c4e3ae7e3bb2ae4cf0d8eb8985bc

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real MsIo32.sys?

file version info and known copies

ProductMsIo64 Driver Version 1.3, MICSYS Technology Co., LTd

DescriptionMICSYS IO driver

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.

What detects it

Sigma

Sigma names MsIo32.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.