YARA Detection Rule: MAL_Driver_Microsoftcorporation_Wantdsys_Microsoftwindowsoperatingsystem_E7AF
Repository: Neo23x0/signature-base
Detects: Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - wantd_6.sys
Author: Florian Roth
Reference: https://github.com/magicsword-io/LOLDrivers

Pattern signatures:
$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]006f006e[1-8][PII_REDACTED]4e[PII_REDACTED]720061006e[PII_REDACTED]6f[PII_REDACTED][PII_REDACTED][PII_REDACTED]650072 } /* FileDescription WANTransportDriver */
		$ = { 0043006f006d[PII_REDACTED]6e0079004e0061006d0065[1-8]004d[PII_REDACTED]72006f0073006f[PII_REDACTED]200043006f[PII_REDACTED]6f[PII_REDACTED]740069006f006e } /* CompanyName MicrosoftCorporation */
		$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED]0069006f006e[1-8]0036002e0031002e[PII_REDACTED]300030002e[PII_REDACTED]370032 } /* FileVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED][PII_REDACTED][PII_REDACTED]730069006f006e[1-8]0036002e0031002e[PII_REDACTED]300030002e[PII_REDACTED]370032 } /* ProductVersion  */
		$ = { 0049006e[PII_REDACTED]72006e0061006c004e0061006d0065[1-8][PII_REDACTED]6e[PII_REDACTED]2e[PII_REDACTED]73 } /* InternalName wantdsys */
		$ = {[PII_REDACTED]6f[PII_REDACTED]630074004e0061006d0065[1-8]004d[PII_REDACTED]72006f0073006f[PII_REDACTED][PII_REDACTED]006e0064006f[PII_REDACTED]20004f[PII_REDACTED][PII_REDACTED]0069006e[PII_REDACTED][PII_REDACTED][PII_REDACTED]6d } /* ProductName Micros

Detection condition:
all of them

Full rule:
rule MAL_Driver_Microsoftcorporation_Wantdsys_Microsoftwindowsoperatingsystem_E7AF {
	meta:
		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - wantd_6.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "e7af7bcb86bd6bab1835f610671c[PII_REDACTED]a839673ac34444cf0ce7b2164e"
		hash = "b9dad0131c51e2645e761b74a71ebad2bf175645fa9f42a4ab0e6921b83306e3"
		hash = "8d9a2363b757d3f127b9c6ed8f7b8b018e652369bc070aa3500b3a978feaa6ce"
		hash = "06a0ec9a316eb89cb041b1907918e3ad3b03842ec65f004f6fa74d57955573a4"
		date = "2024-08-07"
		score = 70
		id = "5f[PII_REDACTED]-5cb4-96bb-988898d47c09"
	strings:
		$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]006f006e[1-8][PII_REDACTED]4e[PII_REDACTED]720061006e[PII_REDACTED]6f[PII_REDACTED][PII_REDACTED][PII_REDACTED]650072 } /* FileDescription WANTransportDriver */
		$ = { 0043006f006d[PII_REDACTED]6e0079004e0061006d0065[1-8]004d[PII_REDACTED]72006f0073006f[PII_REDACTED]200043006f[PII_REDACTED]6f[PII_REDACTED]740069006f006e } /* CompanyName MicrosoftCorporation */
		$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED]0069006f006e[1-8]0036002e0031002e[PII_REDACTED]300030002e[PII_REDACTED]370032 } /* FileVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED][PII_REDACTED][PII_REDACTED]730069006f006e[1-8]0036002e0031002e[PII_REDACTED]300030002e[PII_REDACTED]370032 } /* ProductVersion  */
		$ = { 0049006e[PII_REDACTED]72006e0061006c004e0061006d0065[1-8][PII_REDACTED]6e[PII_REDACTED]2e[PII_REDACTED]73 } /* InternalName wantdsys */
		$ = {[PII_REDACTED]6f[PII_REDACTED]630074004e0061006d0065[1-8]004d[PII_REDACTED]72006f0073006f[PII_REDACTED][PII_REDACTED]006e0064006f[PII_REDACTED]20004f[PII_REDACTED][PII_REDACTED]0069006e[PII_REDACTED][PII_REDACTED][PII_REDACTED]6d } /* ProductName MicrosoftWindowsOperatingSystem */
		$ = { 004f[PII_REDACTED]670069006e0061006c[PII_REDACTED]6c0065006e0061006d0065[1-8][PII_REDACTED]6e[PII_REDACTED]2e[PII_REDACTED]73 } /* OriginalFilename wantdsys */
		$ = { 004c[PII_REDACTED]61006c0043006f[PII_REDACTED][PII_REDACTED]00680074[1-8]004d[PII_REDACTED]72006f0073006f[PII_REDACTED]20004300