LOLDRIVERS_MAL_Driver_Paloaltonetworksinc_Tdevfltsys_Cortexxdradvancedendpointprotection_8284

rule LOLDRIVERS_MAL_Driver_Paloaltonetworksinc_Tdevfltsys_Cortexxdradvancedendpointprotection_8284
{
	meta:
		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - tdevflt.sys, ABYSSWORKER. Investigate matches in context: expected filenames or standard vendor/system driver locations can be lower priority, while unexpected filenames or paths are more suspicious."
		author = "Florian Roth"
		id = "32233331-2e87-52f3-874a-93fe8747efaa"
		date = "2026-07-10"
		modified = "2026-09-08"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9fa32adeab865455de8b24cba0bbc0f3439d59f7/detections/yara/yara-rules_mal_drivers.yar#L1145-L1164"
		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9fa32adeab865455de8b24cba0bbc0f3439d59f7/LICENSE"
		hash = "8284c8676cc22c4b2e66826ac16986da7ddecba1f2776b16771be17bfdc45dc2"
		logic_hash = "46da747e7362e38544ec0e107a02614155b3c235d02add7846a3ffc7537418b5"
		score = 70
		quality = 80
		tags = ""

	strings:
		$ = { 460069006c0065004400650073006300720069007000740069006f006e00[1-8]43006f0072007400650078002000580044005200200050006e00500020004400650076006900630065002000460069006c007400650072002000440072006900760065007200 }
		$ = { 43006f006d00700061006e0079004e0061006d006500[1-8]500061006c006f00200041006c0074006f0020004e006500740077006f0072006b0073002c00200049006e0063002e00 }
		$ = { 460069006c006500560065007200730069006f006e00[1-8]38002e0032002e0032002e0034003900370030003800 }
		$ = { 500072006f006400750063007400560065007200730069006f006e00[1-8]38002e0032002e0032002e0034003900370030003800 }
		$ = { 49006e007400650072006e0061006c004e0061006d006500[1-8]740064006500760066006c0074002e00730079007300 }
		$ = { 500072006f0064007500630074004e0061006d006500[1-8]43006f00720074006500780020005800440052002221200041006400760061006e00630065006400200045006e00640070006f0069006e0074002000500072006f00740065006300740069006f006e00 }
		$ = { 4f0072006900670069006e0061006c00460069006c0065006e0061006d006500[1-8]740064006500760066006c0074002e00730079007300 }
		$ = { 4c006500670061006c0043006f007000790072006900670068007400[1-8]a9002000500061006c006f00200041006c0074006f0020004e006500740077006f0072006b0073002c00200049006e0063002e00200041006c006c002000720069006700680074007300200072006500730065007200760065006400 }

	condition:
		all of them
}