telephonuAfY.sys
Driver on Windows LOLDrivers malicious 1 Sigma rule names it
A known malicious driver
T1068Exploitation for Privilege Escalation
5 known samples
03a0a002c1442a0704d1ef623022bfa0e14c36b132e081ae9d9f1314bb3ad8c887565ff08a93a8ff41ea932bf55dec8e0c7e79aba036507ea45df9d81cb361058d7286b8cfe287062074db12448a829934747e214892572bb858189cdc5f3d9db3439b8478a642c4612cd05fd1dac2f4d622645c5b4387929b9a74c14963c304e39cba0582fa3d9bce412395dc6cef3f9daa6a9396ddce3ca7608120091b3f52From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.
What detects it
Sigma names telephonuAfY.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.