speedfan.sys
SpeedFan Device Driver file version info
Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it
A known vulnerable driver
T1068Exploitation for Privilege Escalation
1 known sample
5.2.3790.0 built by: WinDDK · its entry
22be050955347661685a4343c51f11c7811674e030386d2264cd12ecbf544b7cFrom LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.
Is it the real speedfan.sys?
ProductWindows (R) Server 2003 DDK driver, Windows (R) Server 2003 DDK provider
DescriptionSpeedFan Device Driver
From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.
What detects it
Sigma names speedfan.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.