WiseUnlo.sys
WiseUnlo file version info
Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it
A known vulnerable driver
7 known samples
1.0.2.13 · its entry
358ac54be252673841a1d65bfc2fb6d549c1a4c877fa7f5e1bfa188f30375d691.0.2.13 · its entry
48b1344e45e4de4dfb74ef918af5e0e403001c9061018e703261bbd72dc305481.0.2.13 · its entry
786f0ba14567a7e19192645ad4e40bee6df259abf2fbdfda35b6a38f8493d6cc1.0.2.13 · its entry
87aae726bf7104aac8c8f566ea98f2b51a2bfb6097b6fc8aa1f70adeb4681e1b1.0.2.13 · its entry
daf549a7080d384ba99d1b5bd2383dbb1aa640f7ea3a216df1f08981508155f51.0.1.12 · its entry
5e27fe26110d2b9f6c2bad407d3d0611356576b531564f75ff96f9f72d5fcae41.0.1.12 · its entry
9d530642aeb6524691d06b9e02a84e3487c9cdd86c264b105035d925c984823aFrom LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.
Is it the real WiseUnlo.sys?
From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.
What detects it
Sigma names WiseUnlo.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.