CmdID

CmdID / Files

UCOREW64.SYS

Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it

A known vulnerable driver

from LOLDrivers
T1068Exploitation for Privilege Escalation
Its entryhttps://www.loldrivers.io/drivers/a338a9fc-9fe3-400c-9fe4-69bb7892602d/

1 known sample

its entry

a7c8f4faf3cbb088cac7753d81f8ec4c38ccb97cd9da817741f49272e8d01200

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

What detects it

Sigma

Sigma names UCOREW64.SYS in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.