CmdID / Files

windivert.sys

The WinDivert 2.2 driver [URL: https://reqrypt.org/windivert.html] [Bitcoin: 1C5vZVSbizPeZ8ydTYhUfm4LA2cNwBfcYh] file version info

Driver on Windows LOLDrivers malicious 1 Sigma rule names it

A known malicious driver

from LOLDrivers

T1068Exploitation for Privilege Escalation

Its entryhttps://www.loldrivers.io/drivers/45a31a17-f78d-48ec-beba-74f6bfc5f96e/

3 known samples

2.2 · its entry

2f43f4251be4d72dd56c91bf6cce475d379eb9ba6c4dda2be3022ea633d5e807

2.2 · its entry

8248306bcc5fae20fd4f3d5c44f962c85cddbe020b34a1799350ce2034154b7d

2.2 · its entry

8da085332782708d8767bcace5327a6ec7283c17cfb85e40b03cd2323a90ddc2

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real windivert.sys?

file version info and known copies

ProductWinDivert 2.2 driver, Basil

DescriptionThe WinDivert 2.2 driver [URL: https://reqrypt.org/windivert.html] [Bitcoin: 1C5vZVSbizPeZ8ydTYhUfm4LA2cNwBfcYh]

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.

What detects it

Sigma

Sigma names windivert.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.