TdkLib64.sys
Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it
A known vulnerable driver
T1068Exploitation for Privilege Escalation
17 known samples
Show the 17 samples’ SHA-256 hashes
2695390a8a7448390fe383beb1eee06d582202683f0273d6e72ef39a8cf709e131e2e5c3290989e8624820cf5af886fd778ee8187fed593f33a6178f65103f3738e6d7c2787b6289629c72b1ec87655392267044b4e4b830c0232243657ee8f939f137083e6c0200543e1f8d3c074f857d141bdb8c8f09338d48520537b881aa4c807bacfcf5c30686e26812ec8d5581a824b82fee7434260c27c33eee2dfbe2506f56996fbcd34ff8a27e6948a2e2e21e6dbf42dab6e3a6438402000b969fd15be106b92424b12865338b3f541b3c244dce9693fe15f763316f0c6d6fc073ee5fbfd7c4ea3db1197ad38d5a945acf6f2f42cb350380cf8ae276bc80b0dedb777277130afa0b1506998d7bc58567b0d83f52a27175f4c7c4a7186347095fceed797c1f883d90d25e7fd553624bb16bfd5db24c2658aa0c3c51c715d5833c10fd89bc3cb4522f9b0bf467a93a4123ef623c28244e25a9c34d4aae11f705d187e7aa0c52cebd64a0115c0e7faf4316a52208f738f66a54b4871bd4162eb83dc41abef87650c29faf421e7ad666bf47d7a78a45f291b438c8d1c4b6a66e5b54c6fcbfc121e93fcbf9bd42736cfe7675ae2cc805be9a58f1a0d8cc3aa5b42e49a13fcbd4f66ae09797fcd1dc943261a526710acc8dd4b24e6f67ed4a1fce8b0ae31cdd0bd7b8fae8e8835ba09118a02a06a51e111fccbe16916414844aab91cfeed4e34afe0a8c5459d13e7a11f20d62c7762b2a55613aaf6dbeb887e014b5f19295From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.
What detects it
Sigma names TdkLib64.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.