segwindrvx64.sys
SEG Windows Driver x64 file version info
Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it
A known vulnerable driver
7 known samples
100, 0, 7, 0 · its entry
0d30c6c4fa0216d0637b4049142bc275814fd674859373bd4af520ce173a1c75100, 0, 7, 0 · its entry
7164aaff86b3b7c588fc7ae7839cc09c5c8c6ae29d1aff5325adaf5bedd7c9f5100, 0, 7, 0 · its entry
c628cda1ef43defc00af45b79949675a8422490d32b080b3a8bb9434242bdbf2100, 0, 4, 0 · its entry
38d6d90d543bf6037023c1b1b14212b4fa07731cbbb44bdb17e8faffc12b22e8100, 0, 0, 1 · its entry
0452a6e8f00bae0b79335c1799a26b2b77d603451f2e6cc3b137ad91996d4dec100.00.07.02 · its entry
65329dad28e92f4bcc64de15c552b6ef424494028b18875b7dba840053bc0cdd100.00.07.01 · its entry
b9ae1d53a464bc9bb86782ab6c55e2da8804c80a361139a82a6c8eef30fddd7cFrom LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.
Is it the real segwindrvx64.sys?
From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.
What detects it
Sigma names segwindrvx64.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.