LOLDRIVERS_MAL_Driver_Microsoftcorporation_Windbgsys_Microsoftwindowsoperatingsystem_06C5

rule LOLDRIVERS_MAL_Driver_Microsoftcorporation_Windbgsys_Microsoftwindowsoperatingsystem_06C5
{
	meta:
		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - windbg.sys. Investigate matches in context: expected filenames or standard vendor/system driver locations can be lower priority, while unexpected filenames or paths are more suspicious."
		author = "Florian Roth"
		id = "b73da459-5c4d-5331-84da-2eabb9e0b478"
		date = "2026-04-28"
		modified = "2026-09-08"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9fa32adeab865455de8b24cba0bbc0f3439d59f7/detections/yara/yara-rules_mal_drivers.yar#L1008-L1043"
		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9fa32adeab865455de8b24cba0bbc0f3439d59f7/LICENSE"
		hash = "06c5ebd0371342d18bc81a96f5e5ce28de64101e3c2fd0161d0b54d8368d2f1f"
		hash = "139f8412a7c6fdc43dcfbbcdba256ee55654eb36a40f338249d5162a1f69b988"
		hash = "32882949ea084434a376451ff8364243a50485a3b4af2f2240bb5f20c164543d"
		hash = "4734a0a5d88f44a4939b8d812364cab6ca5f611b9b8ceebe27df6c1ed3a6d8a4"
		hash = "50819a1add4c81c0d53203592d6803f022443440935ff8260ff3b6d5253c0c76"
		hash = "5b932eab6c67f62f097a3249477ac46d80ddccdc52654f8674060b4ddf638e5d"
		hash = "6661320f779337b95bbbe1943ee64afb2101c92f92f3d1571c1bf4201c38c724"
		hash = "6994b32e3f3357f4a1d0abe81e8b62dd54e36b17816f2f1a80018584200a1b77"
		hash = "770f33259d6fb10f4a32d8a57d0d12953e8455c72bb7b60cb39ce505c507013a"
		hash = "86047bb1969d1db455493955fd450d18c62a3f36294d0a6c3732c88dfbcc4f62"
		hash = "bb2422e96ea993007f25c71d55b2eddfa1e940c89e895abb50dd07d7c17ca1df"
		hash = "e1cb86386757b947b39086cc8639da988f6e8018ca9995dd669bdc03c8d39d7d"
		hash = "e6f764c3b5580cd1675cbf184938ad5a201a8c096607857869bd7c3399df0d12"
		hash = "ea50f22daade04d3ca06dedb497b905215cba31aae7b4cab4b533fda0c5be620"
		hash = "f936ec4c8164cbd31add659b61c16cb3a717eac90e74d89c47afb96b60120280"
		hash = "f9f2091fccb289bcf6a945f6b38676ec71dedb32f3674262928ccaf840ca131a"
		hash = "fa9abb3e7e06f857be191a1e049dd37642ec41fb2520c105df2227fcac3de5d5"
		logic_hash = "8e9d30a966ff2c1abb89d05dcd641129984332c60962656d159b19c3c8410617"
		score = 70
		quality = 80
		tags = ""

	strings:
		$ = { 460069006c0065004400650073006300720069007000740069006f006e00[1-8]570069006e0064006f007700730020004700550049002000730079006d0062006f006c0069006300200064006500620075006700670065007200 }
		$ = { 43006f006d00700061006e0079004e0061006d006500[1-8]4d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e00 }
		$ = { 460069006c006500560065007200730069006f006e00[1-8]310030002e0030002e00310039003000340031002e0036003800350020002800570069006e004200750069006c0064002e003100360030003100300031002e0030003800300030002900 }
		$ = { 500072006f006400750063007400560065007200730069006f006e00[1-8]310030002e0030002e00310039003000340031002e00360038003500 }
		$ = { 49006e007400650072006e0061006c004e0061006d006500[1-8]770069006e006400620067002e00730079007300 }
		$ = { 500072006f0064007500630074004e0061006d006500[1-8]4d006900630072006f0073006f00660074003f002000570069006e0064006f00770073003f0020004f007000650072006100740069006e0067002000530079007300740065006d00 }
		$ = { 4f0072006900670069006e0061006c00460069006c0065006e0061006d006500[1-8]770069006e006400620067002e00730079007300 }
		$ = { 4c006500670061006c0043006f007000790072006900670068007400[1-8]3f0020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e00 }

	condition:
		all of them
}