YARA Detection Rule: MAL_Driver_Gentilkiwibenjamindelpy_Mimidrv_Mimidrvmimikatz_14B8
Repository: Neo23x0/signature-base
Detects: Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - mimidrv.sys
Author: Florian Roth
Reference: https://github.com/magicsword-io/LOLDrivers

Pattern signatures:
$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]006f006e[1-8]006d0069006d[PII_REDACTED][PII_REDACTED]0066006f[PII_REDACTED]570069006e0064006f[PII_REDACTED]200028006d0069006d0069006b[PII_REDACTED]7a0029 } /* FileDescription mimidrvforWindowsmimikatz */
		$ = { 0043006f006d[PII_REDACTED]6e0079004e0061006d0065[1-8][PII_REDACTED]6e[PII_REDACTED]6c006b[PII_REDACTED][PII_REDACTED][PII_REDACTED]6e006a0061006d0069006e[PII_REDACTED]45004c[PII_REDACTED]29 } /* CompanyName gentilkiwiBenjaminDELPY */
		$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED]0069006f006e[1-8]0032002e0031002e0030002e0030 } /* FileVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED][PII_REDACTED][PII_REDACTED]730069006f006e[1-8]0032002e0031002e0030002e0030 } /* ProductVersion  */
		$ = { 0049006e[PII_REDACTED]72006e0061006c004e0061006d0065[1-8]006d0069006d[PII_REDACTED]720076 } /* InternalName mimidrv */
		$ = {[PII_REDACTED]6f[PII_REDACTED]630074004e0061006d0065[1-8]006d0069006d[PII_REDACTED][PII_REDACTED]0028006d0069006d0069006b[PII_REDACTED]7a0029 } /* ProductName mimidrvmimikatz */
		$ = { 004f[PII_REDACTED]670069006e00

Detection condition:
all of them

Full rule:
rule MAL_Driver_Gentilkiwibenjamindelpy_Mimidrv_Mimidrvmimikatz_14B8 {
	meta:
		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - mimidrv.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "14b[PII_REDACTED]6f2fd1b1df0961d36fa6354721ea92498a349dc421e79447925"
		hash = "36c65aeb255c06898ffe32e301030e0b74c8bca6fe7be593584b8fdaacd4e475"
		hash = "673bbc7fa4154f7d99af333014e888599c27ead02710f7bc7199184b30b38653"
		hash = "5295080de37d4838e15dec4e[PII_REDACTED]d479d3d9ac28d74747c086559fb968"
		hash = "8684aec77b4c3cafc1a6594de7e95695fa698625d4206a6c4b201875f76a5b38"
		hash = "[PII_REDACTED]6c59772f203c11f5fba30271448e231b65806a66e48f41e3804d7f"
		hash = "a42f4ae69b8755a957256b57eb3d319678eab81705f0ffea0d649ace7321108f"
		hash = "62036cdf[PII_REDACTED]adf3252b921eed06b73c2562655eae36b126c7d3d83266"
		hash = "1ef7afea0cf2ef246ade6606ef8b7195de9cd7a3cd7570bff90ba1e2422276f6"
		hash = "b34e2d9f3d4ef59cf7af18e17133a6a06509373e69e33c8eecb2e30501d0d9e4"
		hash = "0aab2deae90717a8876d46d257401d265cf90a5db4c57706e4003c19eee33550"
		hash = "15cf366f7b3ee526db7ce2b5253ffebcbfaa4f33a82b459237c049f854a97c0c"
		hash = "c4c9c84b211899ceb0d18a839afa497537a7c7c01ab481965a09788a9e16590c"
		hash = "618b[PII_REDACTED]188f4102e5d0638184e2723e8f57f7e917fa49792daebdadb"
		hash = "4bca0a401b364a5cc1581a184116c5bafa224e13782df13272bc1b748173d1be"
		hash = "c7bccc6f38403def4690e00a0b31eda05973d82be8953a3379e331658c51b231"
		hash = "822982c568b6f44b610f8dc4ab5d94795c33ae08a6a[PII_REDACTED]64975c1ecdb"
		hash = "b8c71e1844e987cd6f9c2baf28d9520d4ccdd8593ce7051bb1b3c9bf1d97076a"
		hash = "26bea3b3ab2001d91202f289b7e41499d810474607db7a0893ceab74f5532f47"
		hash = "c8ae217860f793fce3ad0239d7b357dba562824dd7177c9d723ca4d4a7f99a12"
		hash = "a78c9871da09fab21aec9b88a4e880f81ecb1ed0fa941f31cc2f041067e8e972"
		hash = "82b7fa34ad07dbf9afa63b2f6ed37973a1b4fe35dee90b3cf5c788c15c9f08f7"
		hash = "6d68d8a71a11458ddf0cb