PanIOx64.sys
Temperature and system information driver file version info
Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it
A known vulnerable driver
T1068Exploitation for Privilege Escalation
1 known sample
1.0.0.0 · its entry
6b830ea0db6546a044c9900d3f335e7820c2a80e147b0751641899d1a5aa8f74From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.
Is it the real PanIOx64.sys?
ProductPanIO Library, Pan Yazilim Bilisim Teknolojileri Tic. Ltd. Sti.
DescriptionTemperature and system information driver
From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.
What detects it
Sigma names PanIOx64.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.