ntbios.sys

ntbios driver file version info

Driver on Windows LOLDrivers malicious 1 Sigma rule names it

A known malicious driver

from LOLDrivers

T1068Exploitation for Privilege Escalation

Its entrieshttps://www.loldrivers.io/drivers/33a9c9ae-5ca3-442d-9f0f-2615637c1c57/
https://www.loldrivers.io/drivers/eef1fcf4-8c54-420b-8d38-9c5f95129dcc/

2 known samples

5, 0, 2, 1 · its entry

96bf3ee7c6673b69c6aa173bb44e21fa636b1c2c73f4356a7599c121284a51cc

5, 0, 2, 1 · its entry

c0d88db11d0f529754d290ed5f4c34b4dba8c4f2e5c4148866daabeab0d25f9c

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real ntbios.sys?

file version info and known copies

ProductMicrosoft(R) Windows (R) NT Operating System, Microsoft Corporation

Descriptionntbios driver

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.

What detects it

Sigma

Sigma names ntbios.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.