CmdID / Files

rtkio.sys

Realtek IO Driver file version info

Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it

A known vulnerable driver

from LOLDrivers

T1068Exploitation for Privilege Escalation

Its entryhttps://www.loldrivers.io/drivers/8d3f27bd-c3fd-48d0-913a-e2caa6fbd025/

3 known samples

6.0.6000.16386 built by: WinDDK · its entry

478917514be37b32d5ccf76e4009f6f952f39f5553953544f1b0688befd95e82

6.0.6000.16386 built by: WinDDK · its entry

916c535957a3b8cbf3336b63b2260ea4055163a9e6b214f2a7005d6d36a4a677

6.0.6000.16386 built by: WinDDK · its entry

caa85c44eb511377ea7426ff10df00a701c07ffb384eef8287636a4bca0b53ab

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real rtkio.sys?

file version info and known copies

ProductRealtek IO Driver, Realtek

DescriptionRealtek IO Driver

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.

What detects it

Sigma

Sigma names rtkio.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.