phymem_ext64.sys
Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it
A known vulnerable driver
T1068Exploitation for Privilege Escalation
4 known samples
4ec7af309a9359c332d300861655faeceb68bb1cd836dd66d10dd4fac9c01a28793a26c5c4c154a40f84c3d3165deb807062b26796acaae94b72f453e95230d5e26a21e1b79ecaee7033e05edb0bd72aca463c23bd6fdf5835916ce2dfdf1a63fc3e8554602c476e2edfa92ba4f6fb2e5ba0db433b9fbd7d8be1036e454d2584From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.
What detects it
Sigma names phymem_ext64.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.