rtif.sys
INtime PnP RT Kernel Interface Driver file version info
Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it
A known vulnerable driver
7 known samples
500 built by: WinDDK · its entry
0d133ced666c798ea63b6d8026ec507d429e834daa7c74e4e091e462e5815180500 built by: WinDDK · its entry
3670ccd9515d529bb31751fcd613066348057741adeaf0bffd1b9a54eb8baa76500 built by: WinDDK · its entry
9399f35b90f09b41f9eeda55c8e37f6d1cb22de6e224e54567d1f0865a718727500 built by: WinDDK · its entry
a66b4420fa1df81a517e2bbea1a414b57721c67a4aa1df1967894f77e81d036e500 built by: WinDDK · its entry
ba40b1fc798c2f78165e78997b4baf3d99858ee39a372ca6fbc303057793e50d500 built by: WinDDK · its entry
eae5c993b250dcc5fee01deeb30045b0e5ee7cf9306ef6edd8c58e4dc743a8ed420 built by: WinDDK · its entry
4ce8583768720be90fae66eed3b6b4a8c7c64e033be53d4cd98246d6e06086d0From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.
Is it the real rtif.sys?
From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.
What detects it
Sigma names rtif.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.