nvflsh64.sys
Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it
A known vulnerable driver
T1068Exploitation for Privilege Escalation
15 known samples
Show the 15 samples’ SHA-256 hashes
0e9072759433abf3304667b332354e0c635964ff930de034294bf13d40da2a6f1ce9e4600859293c59d884ea721e9b20b2410f6ef80699f8a78a6b9fad505dfc20dd9542d30174585f2623642c7fbbda84e2347e4365e804e3f3d81f530c4ece50aa2b3a762abb1306fa003c60de3c78e89ea5d29aab8a9c6479792d2be3c2d7747a4dc50915053649c499a508853a42d9e325a5eec22e586571e338c6d324657c933f5d07ccb4bd715666cd6eb35a774b266ddd8d212849535a54192a44f6677ef8949637cb947f1a4e1d4e68d31d1385a600d1b1054b53e7417767461fafa7a899b659b08fbae30b182443be8ffb6a6471c1d0497b52293061754886a937a3c188b36f258f38193ace21a7d254f0aec36b59ad7e3f9bcb9c2958108effebade2d6cdc3d8960a50d9f292bb337b3235956a61e4e8b16cf158cb979b777f42aaeef68fdc5df91660410fb9bed005ed08c258c44d66349192faf5bb5f09f5fa90f2a4ddc38e68efd2eac27b2562529926f5ade93575a82e8d3e0abb2b37347257f583cfb8aab7d084dc052dbd0b9d56693308cbb26bd1b607c2aedf8ee2b25e44fe2fb5d6cfcd64aeb62e6bf5b71fd2b2a87886eb97ab59e5353ba740da9f5db5ffd1aef19646ffed09b56a2ace4fc8cdf5b2f714fcca1e7ffb82256264c94b18From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.
What detects it
Sigma names nvflsh64.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.