pchunter.sys
系统信息查看工具 file version info
Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it
A known vulnerable driver
T1068Exploitation for Privilege Escalation
Its entrieshttps://www.loldrivers.io/drivers/73290fcb-a0d7-481e-81a5-65a9859b50f5/
https://www.loldrivers.io/drivers/a261cd64-0d04-4bf5-ad73-f3bb96bf83cf/
https://www.loldrivers.io/drivers/a261cd64-0d04-4bf5-ad73-f3bb96bf83cf/
2 known samples
1.0.0.5 · its entry
3f20ac5dac9171857fc5791865458fdb6eac4fab837d7eabc42cb0a83cb522fc1.0.0.4 · its entry
1b7fb154a7b7903a3c81f12f4b094f24a3c60a6a8cffca894c67c264ab7545faFrom LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.
Is it the real pchunter.sys?
ProductPCHunter, 安芯网盾（北京）科技有限公司
Description系统信息查看工具
From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.
What detects it
Sigma names pchunter.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.