CmdID / Files

shield.sys

Shield disk filter driver file version info

Driver on Windows LOLDrivers vulnerable driver

A known vulnerable driver

from LOLDrivers

T1068Exploitation for Privilege Escalation

Its entryhttps://www.loldrivers.io/drivers/0e272ccf-81e5-4612-95d2-365e7ded6eac/

2 known samples

v13.1 · its entry

b11db76aeab05f29e8f5d51cdfe70898a46fbd50a1245ca1aed39de10aafd401

v13.1 · its entry

b1547490f3040b1e3668ee195adbf2d312024809915d01a71ed75fae72971a9d

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real shield.sys?

file version info and known copies

ProductReboot Restore Standard, Horizon Datasys, Inc.

DescriptionShield disk filter driver

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.