netfilterdrv.sys
Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it
A known vulnerable driver
T1068Exploitation for Privilege Escalation
5 known samples
115034373fc0ec8f75fb075b7a7011b603259ecc0aca271445e559b5404a14061aa8ba45f9524847e2a36c0dc6fd80162923e88dc1be217dde2fb5894c65ff435bdba1561ec5b23b1d56ea8cee411147d1526595f03a9281166a563b3641fa2a70b63dfc3ed2b89a4eb8a0aa6c26885f460e5686d21c9d32413df0cdc5f962c7c8926e31be2d1355e542793af8ff9ccc4d1d60cae40c9564b2400dd4e1090bdaFrom LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.
What detects it
Sigma names netfilterdrv.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.