WCPU.sys
ASUS TDE CPU Driver file version info
Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it
A known vulnerable driver
T1068Exploitation for Privilege Escalation
1 known sample
6.0.6000.16386 built by: WinDDK · its entry
159e7c5a12157af92e0d14a0d3ea116f91c09e21a9831486e6dc592c93c10980From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.
Is it the real WCPU.sys?
ProductWindows (R) Codename Longhorn DDK driver, Windows (R) Codename Longhorn DDK provider
DescriptionASUS TDE CPU Driver
From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.
What detects it
Sigma names WCPU.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.