YARA Detection Rule: MAL_Driver_Gentilkiwibenjamindelpy_Mimidrv_Mimidrvmimikatz_AAF0
Repository: Neo23x0/signature-base
Detects: Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - mimidrv.sys
Author: Florian Roth
Reference: https://github.com/magicsword-io/LOLDrivers

Pattern signatures:
$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]006f006e[1-8]006d0069006d[PII_REDACTED][PII_REDACTED]0066006f[PII_REDACTED]570069006e0064006f[PII_REDACTED]200028006d0069006d0069006b[PII_REDACTED]7a0029 } /* FileDescription mimidrvforWindowsmimikatz */
		$ = { 0043006f006d[PII_REDACTED]6e0079004e0061006d0065[1-8][PII_REDACTED]6e[PII_REDACTED]6c006b[PII_REDACTED][PII_REDACTED][PII_REDACTED]6e006a0061006d0069006e[PII_REDACTED]45004c[PII_REDACTED]29 } /* CompanyName gentilkiwiBenjaminDELPY */
		$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED]0069006f006e[1-8]0032002e0032002e0030002e0030 } /* FileVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED][PII_REDACTED][PII_REDACTED]730069006f006e[1-8]0032002e0032002e0030002e0030 } /* ProductVersion  */
		$ = { 0049006e[PII_REDACTED]72006e0061006c004e0061006d0065[1-8]006d0069006d[PII_REDACTED]720076 } /* InternalName mimidrv */
		$ = {[PII_REDACTED]6f[PII_REDACTED]630074004e0061006d0065[1-8]006d0069006d[PII_REDACTED][PII_REDACTED]0028006d0069006d0069006b[PII_REDACTED]7a0029 } /* ProductName mimidrvmimikatz */
		$ = { 004f[PII_REDACTED]670069006e00

Detection condition:
all of them

Full rule:
rule MAL_Driver_Gentilkiwibenjamindelpy_Mimidrv_Mimidrvmimikatz_AAF0 {
	meta:
		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - mimidrv.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "aaf04d89fd15bc61265e545f8e1da80e20f59f90058ed343c62ee24358e3af9e"
		hash = "4b97d63ebdeda6941bb8cef5e94741c6cca75237ca830561f[PII_REDACTED]f0919"
		hash = "c42c1e5c3c04163bf61c3b86b04a5ec7d302af7e254990cef359ac80474299da"
		hash = "f03f0fb3a26bb83e8f8fa426744cf06f2e6e29f5220663b1d64265952b8de1a1"
		hash = "0f98492c92e35042b09032e3d9aedc357e4df94fc840217fa1091046f9248a06"
		hash = "d032001eab6cad4fbef19aab418650ded00152143bd14507e17d62748297c23f"
		hash = "2456a7921fa8ab7b9779e5665e6b42fccc019feb9e49a9a28a33ec0a4bb323c4"
		hash = "f9b01406864ab081aa77eef4ad15cb2dd2f830d1ef54f52622a59ff1aeb05ba5"
		hash = "19dfacea1b9f19c0379f89b2424ceb028f2ce59b0db991ba83ae[PII_REDACTED]87"
		hash = "3ca5d47d076e99c312578ef6499e1fa7b9db88551cfc0f138da11105aca7c5e1"
		hash = "cf9451c9ccc5509b9912965f79c2b95eb89d805b2a186d7521d3a262cf5a7a37"
		hash = "a0931e16cf7b18d15579e36e0a69edad1717b07527b5407f2c105a2f554224b2"
		hash = "492113a223d6a3fc110059fe46a180d82bb8e002ef2cd76cbf0c1d1eb8243263"
		hash = "85b9d7344bf847349b5d58ebe4d44fd63679a[PII_REDACTED]1593ef1076aa163b2"
		hash = "efa56907b9d0ec4430a5d581f490b6b9052b1e979da4dab6a110ab92e17d4576"
		hash = "12b0000698b79ea3c8178b9e87801cc34bad096a151a[PII_REDACTED]deafd4e3f0"
		hash = "4136f1eb11cc463a858393ea733d5f1c220a[PII_REDACTED]f7f5d63eccf7c5a03f"
		hash = "ee525b90053bb30908b5d7bf4c5e9b8b9d6b7b5c9091a26fa25d30d3ad8ef5d0"
		hash = "10ad50fcb360dcab8539ea322aaf2270565dc835b[PII_REDACTED]348523d723d6b"
		hash = "4d42678df3917c37f44a1506307f1677b9a689efcf350b1acce7e6f64b514905"
		hash = "d37996abc8efb29f1ccbb4335ce9ba9158bec86cc4775f0177112e87e4e3be5c"
		hash = "569fe70bedd0df8585689b0e88ad8bd0544fdf88b9dbfc2076f4bdbcf89c28aa"
		hash = "80e4c83cfa9d675a6746a