WINIODrv.sys
Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it
A known vulnerable driver
T1068Exploitation for Privilege Escalation
3 known samples
3243aab18e273a9b9c4280a57aecef278e10bfff19abb260d7a7820e417390997cfa5e10dff8a99a5d544b011f676bc383991274c693e21e3af40cf6982adb8cc9b49b52b493b53cd49c12c3fa9553e57c5394555b64e32d1208f5b96a5b8c6eFrom LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.
What detects it
Sigma names WINIODrv.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.