CmdID

CmdID / Files

nscm.sys

Novell XTier Session Manager file version info

Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it

A known vulnerable driver

from LOLDrivers
T1068Exploitation for Privilege Escalation
Its entrieshttps://www.loldrivers.io/drivers/351ff5ca-f07b-4eb6-9300-d5d31514defb/
https://www.loldrivers.io/drivers/90afa27c-0f67-46a6-b4a9-809f55157c71/

26 known samples

Show the 26 samples’ SHA-256 hashes

3.1.12.0 · its entry

1675eedd4c7f2ec47002d623bb4ec689ca9683020e0fdb0729a9047c8fb953dd

3.1.12.0 · its entry

5351c81b4ec5a0d79c39d24bac7600d10eac30c13546fde43d23636b3f421e7c

3.1.12.0 · its entry

c6feb3f4932387df7598e29d4f5bdacec0b9ce98db3f51d96fc4ffdcc6eb10e1

3.1.12.0 · its entry

e7b79fe1377b3da749590c080d4d96e59e622b1013b2183b98c81baa8bf2fffe

3.1.12.0 · its entry

f77fe6b1e0e913ac109335a8fa2ac4961d35cbbd50729936059aba8700690a9e

3.1.11.0 · its entry

202d9703a5b8d06c5f92d2c5218a93431aa55af389007826a9bfaaf900812213

3.1.11.0 · its entry

2e665962c827ce0adbd29fe6bcf09bbb1d7a7022075d162ff9b65d0af9794ac0

3.1.11.0 · its entry

49ef680510e3dac6979a20629d10f06822c78f45b9a62ec209b71827a526be94

3.1.11.0 · its entry

5a661e26cfe5d8dedf8c9644129039cfa40aebb448895187b96a8b7441d52aaa

3.1.11.0 · its entry

653f6a65e0e608cae217bea2f90f05d8125cf23f83ba01a60de0f5659cfa5d4d

3.1.11.0 · its entry

76660e91f1ff3cb89630df5af4fe09de6098d09baa66b1a130c89c3c5edd5b22

3.1.11.0 · its entry

a855b6ec385b3369c547a3c54e88a013dd028865aba0f3f08be84cdcbaa9a0f6

3.1.11.0 · its entry

b0b6a410c22cc36f478ff874d4a23d2e4b4e37c6e55f2a095fc4c3ef32bcb763

3.1.11.0 · its entry

fb81b5f8bf69637dbdf050181499088a67d24577587bc520de94b5ee8996240f

3.1.10.0 · its entry

0cf91e8f64a7c98dbeab21597bd76723aee892ed8fa4ee44b09f9e75089308e2

3.1.10.0 · its entry

f62911334068c9edd44b9c3e8dee8155a0097aa331dd4566a61afa3549f35f65

3.1.6.0 · its entry

003e61358878c7e49e18420ee0b4a37b51880be40929a76e529c7b3fb18e81b4

3.1.6.0 · its entry

14938f68957ede6e2b742a550042119a8fbc9f14427fb89fa53fff12d243561c

3.1.6.0 · its entry

28999af32b55ddb7dcfc26376a244aa2fe297233ce7abe4919a1aef2f7e2cee7

3.1.6.0 · its entry

41eeeb0472c7e9c3a7146a2133341cd74dd3f8b5064c9dee2c70e5daa060954f

3.1.6.0 · its entry

53810ca98e07a567bb082628d95d796f14c218762cbbaa79704740284dccda4b

3.1.6.0 · its entry

8e88cb80328c3dbaa2752591692e74a2fae7e146d7d8aabc9b9ac9a6fe561e6c

3.1.6.0 · its entry

a495ffa623a5220179b0dd519935e255dd6910b7b7bc3d68906528496561ff53

3.1.6.0 · its entry

ce23c2dae4cca4771ea50ec737093dfafac06c64db0f924a1ccbbf687e33f5a2

3.1.6.0 · its entry

e4cf438838dc10b188b3d4a318fd9ba2479abb078458d7f97591c723e2d637ce

2.0.0.0 · its entry

ca34f945117ec853a713183fa4e8cf85ea0c2c49ca26e73d869fee021f7b491d

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real nscm.sys?

file version info and known copies
ProductNovell XTier, Novell, Inc.
DescriptionNovell XTier Session Manager

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.

What detects it

Sigma

Sigma names nscm.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.