CmdID / Files

SBIOSIO64.sys

SBIOSIO Driver file version info

Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it

A known vulnerable driver

from LOLDrivers

T1068Exploitation for Privilege Escalation

Its entryhttps://www.loldrivers.io/drivers/cf805b21-4611-4983-a8b6-271373a45057/

4 known samples

1.1.0000.0 · its entry

442d506c1ac1f48f6224f0cdd64590779aee9c88bdda2f2cc3169b862cba1243

1.1.0000.0 · its entry

b3d1bdd4ad819b99870b6e2ed3527dfc0e3ce27b929ad64382b9c3d4e332315c

1.0.0000.0 · its entry

1e24c45ce2672ee403db34077c88e8b7d7797d113c6fd161906dce3784da627d

1.0.0000.0 · its entry

39336e2ce105901ab65021d6fdc3932d3d6aab665fe4bd55aa1aa66eb0de32f0

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real SBIOSIO64.sys?

file version info and known copies

ProductSamsung (R) BIOS IO driver, Windows (R) Win 7 DDK provider

DescriptionSBIOSIO Driver

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.

What detects it

Sigma

Sigma names SBIOSIO64.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.