winio64.sys
Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it
A known vulnerable driver
T1068Exploitation for Privilege Escalation
Its entrieshttps://www.loldrivers.io/drivers/1ff757df-9a40-4f78-a28a-64830440abf7/
https://www.loldrivers.io/drivers/94eb0694-29ba-4f8e-b763-86c6371db6cc/
https://www.loldrivers.io/drivers/96501e5b-e4f2-41a9-a8ee-d09e36d31a39/
https://www.loldrivers.io/drivers/94eb0694-29ba-4f8e-b763-86c6371db6cc/
https://www.loldrivers.io/drivers/96501e5b-e4f2-41a9-a8ee-d09e36d31a39/
9 known samples
15fb486b6b8c2a2f1b067f48fba10c2f164638fe5e6cee618fb84463578ecac9175e32800edf65d0027821ed2f484088ab4e935527f8a1bd83010a005dec4a5e462fdbbc7a638d5168a3017ebd333dab90fbb44c045aa2d65d7df3667e364b779fc29480407e5179aa8ea41682409b4ea33f1a42026277613d6484e5419de374bbb7e83911abdedfc9529e9329d0f90cf7c94a7d00845b610c5f7099efaca492be929ae99015fafa0ab55cb475035e8c1359db1b61e00507defc1919a3538385dbe9f17313e1164f06401234b875fbc7f71d41dc7271de643865af1358841fefe1980c6592e6d2d92c1a65acad8f1071b6a404097bb6fcce494f3c8ac31385cfeaaed21c1788baca09ee16b06e1a231cb11c8417b3949d7d90596d50305dc604From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.
What detects it
Sigma names winio64.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.