YARA Detection Rule: PUA_VULN_Renamed_Driver_Cpuid_Cpuzsys_Cpuidservice_0D37
Repository: Neo23x0/signature-base
Detects: Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - cpuz.sys
Author: Florian Roth
Reference: https://github.com/magicsword-io/LOLDrivers

Pattern signatures:
$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]006f006e[1-8][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]00650072 } /* FileDescription CPUIDDriver */
		$ = { 0043006f006d[PII_REDACTED]6e0079004e0061006d0065[1-8][PII_REDACTED][PII_REDACTED] } /* CompanyName CPUID */
		$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED]0069006f006e[1-8]0036002e0031002e[PII_REDACTED]300030002e[PII_REDACTED][PII_REDACTED][PII_REDACTED]750069006c[PII_REDACTED]620079003a[PII_REDACTED]69006e[PII_REDACTED]4b } /* FileVersion builtbyWinDDK */
		$ = {[PII_REDACTED]6f[PII_REDACTED][PII_REDACTED][PII_REDACTED]730069006f006e[1-8]0036002e0031002e[PII_REDACTED]300030002e[PII_REDACTED][PII_REDACTED] } /* ProductVersion  */
		$ = { 0049006e[PII_REDACTED]72006e0061006c004e0061006d0065[1-8][PII_REDACTED]75007a002e[PII_REDACTED]73 } /* InternalName cpuzsys */
		$ = {[PII_REDACTED]6f[PII_REDACTED]630074004e0061006d0065[1-8][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]65 } /* ProductName CPUIDservice */
		$ = { 004f[PII_REDACTED]670069006e0061006c[PII_REDACTED]6c0065006e0061006d0065[1-8][PII_REDACTED]75007a002e[PII_REDACTED]7

Detection condition:
uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /cpuz/i

Full rule:
rule PUA_VULN_Renamed_Driver_Cpuid_Cpuzsys_Cpuidservice_0D37 {
	meta:
		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - cpuz.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "0d3790af5f8e5c945410929e31d06144a471ac82f828afe89a4758a5bbeb7f9f"
		hash = "523d1d43e896077f32cd9acaa8e85b513bfb7b013a625e56f0d4e9675d9822ba"
		hash = "df0dcfb3971829af79629efd036b8e1c6e2127481b3644ccc6e2ddd387489a15"
		hash = "636b4c1882bcdd19b56370e2ed744e059149c64c96de64ac595f20509efa6220"
		hash = "e51ec2876af3c9c3f1563987a9a35a10f091ea25ede16b1a34ba2648c53e9dfc"
		hash = "9a523854fe84f15efc1635d7f5d3e71812c45d6a4d2c99c29fdc4b4d9c84954c"
		hash = "d0543f0fdc589c921b47877041f01b17a534c67dcc7c5ad60beba8cf7e7bc9c6"
		hash = "b9695940f72e3ed5d7369fb32958e2146abd29d5895d91ccc22dfbcc9485b78b"
		hash = "b01ebea651ec7780d0fe88dd1b6c2500a36dacf85e3a4038c2ca1c5cb44c7b5d"
		hash = "8c95d28270a4a314299cf50f05dcbe63033b2a555195d2ad2f678e09e00393e6"
		hash = "1ee59eb28688e73d10838c66e0d8e011c8df45b6b43a4ac5d0b75795ca3eb512"
		hash = "c8f0bb5d8836e21e7a22a406c69c01ba7d512a808c37c45088575d548ee25caa"
		hash = "5b3705b47dc15f2b61ca3821b883b9cd114d83fcc3344d11eb1d3df495d75abe"
		hash = "67734c7c0130dd66c964f76965f09a2290da4b14c94412c0056046e700654bdc"
		hash = "a11cf43794ea5b5122a0851bf7de08e559f6e9219c77f9888ff740055f2c155e"
		hash = "80eeb8c2890f3535ed14f5881baf2f2226e6763be099d09fb8aadaba5b4474c1"
		hash = "19696fb0db3fcae22f705ae1eb1e9f1151c823f3ff5d8857e90f2a4a6fdc5758"
		hash = "e58bbf3251906ff722aa63415bf169618e78be85cb92c8263d3715c260491e90"
		hash = "11d258e05b850dcc9ecfacccc9486e54bd928aaa3d5e9942696c323fdbd3481b"
		date = "2024-08-07"
		score = 70
		id = "4de41d13-ffdc-56fa-a5fe-c72ea5bf872f"
	strings:
		$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]006f006e[1-8][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]00650072 } /* FileDescription CPUIDDriver */
		$ = { 0043