CmdID

RwDrv.sys

RW-Everything Read & Write Driver file version info

Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it

A known vulnerable driver

from LOLDrivers

T1068Exploitation for Privilege Escalation

Its entrieshttps://www.loldrivers.io/drivers/19d16518-4aee-4983-ba89-dbbe0fa8a3e7/
https://www.loldrivers.io/drivers/31797996-6973-402d-a4a0-d01ce51e02c0/
https://www.loldrivers.io/drivers/57f63efb-dc43-4dba-9413-173e3e4be750/

14 known samples

Show the 14 samples’ SHA-256 hashes

1.00.00.0000 built by: WinDDK · its entry

0aafa9f47acf69d46c9542985994ff5321f00842a28df2396d4a3076776a83cb

1.00.00.0000 built by: WinDDK · its entry

1e0eb0811a7cf1bdaf29d3d2cab373ca51eb8d8b58889ab7728e2d3aed244abe

1.00.00.0000 built by: WinDDK · its entry

2470fd1b733314c9b0afa19fd39c5d19aa1b36db598b5ebbe93445caa545da5f

1.00.00.0000 built by: WinDDK · its entry

2a652de6b680d5ad92376ad323021850dab2c653abf06edf26120f7714b8e08a

1.00.00.0000 built by: WinDDK · its entry

2bf29a2df52110ed463d51376562afceac0e80fbb1033284cf50edd86c406b14

1.00.00.0000 built by: WinDDK · its entry

3279593db91bb7ad5b489a01808c645eafafda6cc9c39f50d10ccc30203f2ddf

1.00.00.0000 built by: WinDDK · its entry

3384f4a892f7aa72c43280ff682d85c8e3936f37a68d978d307a9461149192de

1.00.00.0000 built by: WinDDK · its entry

45ba688a4bded8a7e78a4f5b0dc21004e951ddceb014bb92f51a3301d2fbc56a

1.00.00.0000 built by: WinDDK · its entry

47f08f7d30d824a8f4bb8a98916401a37c0fd8502db308aba91fe3112b892dcc

1.00.00.0000 built by: WinDDK · its entry

83fbf5d46cff38dd1c0f83686708b3bd6a3a73fddd7a2da2b5a3acccd1d9359c

1.00.00.0000 built by: WinDDK · its entry

bdcacb9f373b017d0905845292bca2089feb0900ce80e78df1bcaae8328ce042

1.00.00.0000 built by: WinDDK · its entry

d15a0bc7a39bbeff10019496c1ed217b7c1b26da37b2bdd46820b35161ddb3c4

1.00.00.0000 built by: WinDDK · its entry

d969845ef6acc8e5d3421a7ce7e244f419989710871313b04148f9b322751e5d

1.00.00.0000 built by: WinDDK · its entry

ea0b9eecf4ad5ec8c14aec13de7d661e7615018b1a3c65464bf5eca9bbf6ded3

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real RwDrv.sys?

file version info and known copies

ProductRW-Everything Read & Write Driver, RW-Everything

DescriptionRW-Everything Read & Write Driver

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.

What detects it

Sigma

Sigma names RwDrv.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.