RTCore64.sys
Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it
A known vulnerable driver
T1068Exploitation for Privilege Escalation
Its entrieshttps://www.loldrivers.io/drivers/275c80c5-a67c-4536-b29e-4e481242cb01/
https://www.loldrivers.io/drivers/e32bc3da-4db1-4858-a62c-6fbe4db6afbd/
https://www.loldrivers.io/drivers/e32bc3da-4db1-4858-a62c-6fbe4db6afbd/
76 known samples
Show the 76 samples’ SHA-256 hashes
01aa278b07b58dc46c84bd0b1b5c8e9ee4e62ea0bf7a695862444af32e87f1fd03e0581432f5c8cc727a8aa387f5b69ff84d38d0df6f1226c19c6e960a81e1e90466dac557ee161503f5dfbd3549f81ec760c3d6c7c4363a21a03e7a3f66aca8077aa8ff5e01747723b6d24cc8af460a7a00f30cd3bc80e41cc245ceb830535608828990218ebb4415c1bb33fa2b0a009efd0784b18b3f7ecd3bc078343f72080aca4447ee54d635f76b941f6100b829dc8b2e0df27bdf584acb90f15f12fbda0cf6c6c2d231eaf67dfc87561cc9a56ecef89ab50baafee5a67962748d51faf30e10d3c73596e359462dc6bfcb886768486ff59e158f0f872d23c5e9a2f7c16811208bbba148736309a8d2a4ab9ab6b8f22f2297547b100d8bdfd7d413fe98b21766fd66f846d9a21e648d649ad35d1ff94f8ca17a40a9a738444d6b8e07aacb18712a063574bfec315d58577dfe413ab45b650e54747d1e18a56c3c7337a12c1c425793a8ce87be916969d6d7e9dd0687b181565c3b483ce53ad1ec6fb72a171cedd5815bb6e20d3697103cfc0275f5015f469e6007e8cac16892c97731c69522e125c284a55eb730f03ec27b87ab84cf897f9d046b91c76bea2b5809fd51c53ac8e54be2804f5fa60d0d23a11ba323fba078a942c96279425aabad935b82363c5d7069f85ec1d6f58147431f88c4d7c48df73baf94ffdefd664f2606baf09c3ff50c67d51553c08dcb7c98342f68a0f54ad6658c5346c428bdcd1f185569f640061b30b1243be76d5283cbc8abfe007e148097d4de7337670ff1536c4c7ba14b4c925c3b8285aeeab9b954e8b2a0773b4d2d0e18d07d4a9d268f4be90f6cae4eb1b9f3fe3c79f20c9cdeba92f6d6eb9b9ed15b546851e1f5338c0b7d36364b53eaefba7e7dca9ab74e385abf18762f9f1aa51594e7f7db5ba612d6c787dd7e54bf602a6f1baaec5809a630a5c33f76f1c3147e4b05cecf17b96a93b1d41dca5ab48bf8c099611b217cc9f78af2f92e9aaeedf1cea4c95d5dd562f51e9f0d095da0ffe33987f8d5fb9c151f0eff29b99f42233b27efcad596add27bdc5c88ff5de78cf5f0b1b09e7145db84e91a2223c3ed4d83cceb3ef073c068cf88b9d4445f20541f859f21b3106e12d37182b1ea39bb75ffcfcddb2ece4f6edd42c0bab25f7e47d728ac3301eb47b409801a0f4726a435f78f1ed02c30d2a926259c71f35fe5a6f88fbbc85be9efe81204eee11dff1a683b426019d330b1276a3b5424f4613d6cc154586c21b330018142a89eac4504e185f0be7f86af975e5b6c046c5563af3fdb1e85949c8adccb43f09ca4556ae258b363a99ae599e1e834d34c867067cd6166d791bdf74453e19c015b2cb1e85e41892c04580034b65f9f03fe2e7967e9d1f6f7ed58d86b025d3578cb7a3f3c389b9dd425b7f46bb1056e83bffc78696679114f6a106ec94c21e2a33fe17af86368bcf9a796aaea37ea6e8748ad6a6cb6e23ba516570bbd158c32f7c7c99f19b24ca4437340ecb39253662afe42937149fbd191d7e4941a32a3118ab017426b551d5d369f20c94c4f36ae4ef54f267da6113183328d4fddf6937c0c85ef65ba69bfe133b1146193a25bcf6ae1f9dd7f5dc63e5742096e4accaca39ae77a2a2142b438c10f97860dee4054b51d3b357fc01f25c4c18a6c539cda38fdbf34b2ff02a15ffd1d93a7215e1f48f76fb3be8399e5afd8e3e97139dffb1a9fb00db2186321b427f164403282217cab067c38862d0ff27bb086145a33b9261142838651b0d2e1403be321145e197600eb501596df0b01eeba3e6e50759d400df380db27f0d0e34812d0374d22ac17582304529f1025601d17945c3a47026814bdec353ee363966e62dba7fe2673da5ce50defa0dd3d43ab891777b11d4fdcb3b7f246b80bc66d12f7810cf268a5f6f4f8eb7ba10b4ed33a13c08804da8b46fd1b7bd653a6f2bb65668e82086de1940c5bb5d1a6c05b10a5c090b743a61fa225b09e390e2dd2bd6cb4fd96b987f1e0d3f2124aaafb95a443911e4c67d4e45ffa83cca103c91b42915b81100534dc439bec0c1bad0309c2d225d8540a47250e3773876e05ce6a47a7767511e2f68645562c0686ad215185dc833c54d523350ef3dbc10b3357a88fc4dde00281d9af81ea0764d5ae6fb53e4d8122dba3a65e5fa59185b36c3ac9df46e82fcfb6731ab55c6395aab1867d13a4cab66a76f4d4448824ca0cb3a176064626f9618c0c103ee3cb4f47b61869b7945be062630f1dd4bae919aecee8927f7e1bc3954a21ff763f4c0867b749566057dee0439f54b0d38935e5939b5cb011c46d7022530f748ebc63efe5bac1cd96ba242cdf29f8feac501110739f1524f0db1c8fcad59409e77b8928babb0742036c82709e02f25f98a9ff37c36a8c228bcaa98e40629fac8cde95b421bbbeb5020b58e6942ec7dec0d1d518e95fc12ddae43f54ef0829d3393c6afd63bc13adeb6bf62b1e10ef41205ef92382e6c18d6a20669d288a0b11058e533d63c181ce9a57e8d763db89ba7c45702a8cf66ef1bb58e3f21874cf0265711f886bcdd2a4575a46bada4837a6153a79c14d60ee3129830717ef09e0e3efd9d00812d21aba58222930cb75946a0fb72b4adc96de583d3f7d8dc13829b804eb877257d3eaf041ce5f3fd59885ead2cb4ce5c61ac9d83d41f626512942a50e3da7b75ad7a61c671eab1dfaa62fe1088a85f6d52fb11f2f32a53822a49521ca2c16585ed7ddf874304556f8a10942a29b3d387cb5155a7419f87813557fe728cb14806dd9a2bf0f5ba185170441f003dc46fbb570e1c9fdf2132ab7de28b87ba7ad1a0cd9a3dc47699949c8ec0c704346fb2ee86ff9010daa0dbac953cfa5f76b52fcd1dd2c1aa4e14c825f3715891bfa2b6264650a794f366d5f73ed1ef1d79ff0dbf9df0cc4e5c9802f8edaefeb130e375cad56b2c5490d8ebd77d8dbdcc6fdc7ecb6e2d8dd5dacc24051709f55a35184f5f99aef957a83bd358b0608b4479e1ec24fe50b25d94c1771937b2f632e10eea875ac6b19c57da703d52e23ad2b6299f0aee6a2b1937fa277526a1e0ca9f9b32f85ab9cb7cb1a32250dd9c607e93fc2924ff1c8ca232789c2f11a511c8cd95a9f3830dd719cad5aa22cb7c3539ab8cb4dc3f37d609ea1f06660d970415dd3916c4c153bb5940bf7d2beb47fa34e8a8ffbfcf48f31bf9c6abbd44124b66bce2ab1200176e31ef1e901733761f2b5ceb60fb2f84f8173242b95f9f3c4fea99b5555b33f9ce37ca8188b643871d261cb081496f9895458e73d4b0ef01eda347fb695bb00e6598d9f5e2506161b70ad96bb7298f9bc6b2d5822c5b3a7b1023adceb25b47b41e664347860be4603ee81b644590efded693528f7e6ac1af253e0bd2726607308fdaa904f1e7242ed44e1c0b29ae8From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.
What detects it
Sigma names RTCore64.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.