WinRing0.sys
WinRing0 file version info
Driver on Windows LOLDrivers vulnerable driver 2 Sigma rules name it
A known vulnerable driver
8 known samples
1.2.0.6 · its entry
489c0e3a8d70037eba46810c0d1c93a10e2796d809eb35023e5977d6902cb7441.2.0.5 · its entry
11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee51.2.0.5 · its entry
206ee7a7c3f4d9496f742ccb84718f556ecb4ba2a95fe7e0cdf3a003ffbe45971.2.0.5 · its entry
3eb166c2117da2dd9a43bd2fbb083d2d4535e9f57c5060053986c06bf3dd275f1.2.0.5 · its entry
a3e3cdbd8c781960a77efb5655a6b7c3bac8d5926aaf687108a57d99b78538fc1.2.0.5 · its entry
a7b000abbcc344444a9b00cfade7aa22ab92ce0cadec196c30eb1851ae4fa0621.0.1.2 · its entry
3ec5ad51e6879464dfbccb9f4ed76c6325056a42548d5994ba869da9c4c039a81.0.1.2 · its entry
47eaebc920ccf99e09fc9924feb6b19b8a28589f52783327067c9b09754b5e84From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.
Is it the real WinRing0.sys?
From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.
What detects it
Sigma names WinRing0.sys in 2 rules, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.