NTIOLib_X64.sys

NTIOLib file version info

Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it

A known vulnerable driver

from LOLDrivers

T1068Exploitation for Privilege Escalation

Its entrieshttps://www.loldrivers.io/drivers/54d67d79-0268-4c5f-be7e-0f74cd20828a/
https://www.loldrivers.io/drivers/a7bba474-815f-49be-bddc-4d76a64c866c/

4 known samples

1.0.0.2 · its entry

09bedbf7a41e0f8dabe4f41d331db58373ce15b2e9204540873a1884f38bdde1

1.0.0.1 · its entry

1e8b0c1966e566a523d652e00f7727d8b0663f1dfdce3b9a09b9adfaef48d8ee

1.0.0.1 · its entry

5d530e111400785d183057113d70623e17af32931668ab7c7fc826f0fd4f91a3

1.0.0.1 · its entry

cc586254e9e89e88334adee44e332166119307e79c2f18f6c2ab90ce8ba7fc9b

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real NTIOLib_X64.sys?

file version info and known copies

ProductNTIOLib, MSI

DescriptionNTIOLib

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.

What detects it

Sigma

Sigma names NTIOLib_X64.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.