YARA Detection Rule: MAL_Driver_Microsoftcorporation_Windbgsys_Microsoftwindowsoperatingsystem_6994
Repository: Neo23x0/signature-base
Detects: Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - windbg.sys
Author: Florian Roth
Reference: https://github.com/magicsword-io/LOLDrivers

Pattern signatures:
$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]006f006e[1-8][PII_REDACTED]6e0064006f[PII_REDACTED][PII_REDACTED][PII_REDACTED]730079006d0062006f006c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0072 } /* FileDescription WindowsGUIsymbolicdebugger */
		$ = { 0043006f006d[PII_REDACTED]6e0079004e0061006d0065[1-8]004d[PII_REDACTED]72006f0073006f[PII_REDACTED]200043006f[PII_REDACTED]6f[PII_REDACTED]740069006f006e } /* CompanyName MicrosoftCorporation */
		$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED]0069006f006e[1-8][PII_REDACTED]2e0030002e[PII_REDACTED][PII_REDACTED]002e[PII_REDACTED][PII_REDACTED][PII_REDACTED]6e[PII_REDACTED]69006c0064002e[PII_REDACTED][PII_REDACTED]0031002e[PII_REDACTED][PII_REDACTED] } /* FileVersion WinBuild */
		$ = {[PII_REDACTED]6f[PII_REDACTED][PII_REDACTED][PII_REDACTED]730069006f006e[1-8][PII_REDACTED]2e0030002e[PII_REDACTED][PII_REDACTED]002e[PII_REDACTED]35 } /* ProductVersion  */
		$ = { 0049006e[PII_REDACTED]72006e0061006c004e0061006d0065[1-8][PII_REDACTED]6e[PII_REDACTED]67002e[PII_REDACTED]73 } /* InternalName windbgsys */
		$ = {[PII_REDACTED]6f[PII_REDACTED]630074004e0061006d0065[1-8]004

Detection condition:
all of them

Full rule:
rule MAL_Driver_Microsoftcorporation_Windbgsys_Microsoftwindowsoperatingsystem_6994 {
	meta:
		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - windbg.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "6994b32e3f3357f4a1d0abe81e8b62dd54e36b17816f2f1a[PII_REDACTED]0a1b77"
		hash = "5b932eab6c67f62f097a3249477ac46d80ddccdc52654f8674060b4ddf638e5d"
		hash = "ea50f22daade04d3ca06dedb497b905215cba31aae7b4cab4b533fda0c5be620"
		hash = "f936ec4c8164cbd31add659b61c16cb3a717eac90e74d89c47afb96b60120280"
		hash = "32882949ea084434a376451ff8364243a50485a3b4af2f2240bb5f20c164543d"
		hash = "6661320f779337b95bbbe1943ee64afb2101c92f92f3d1571c1bf4201c38c724"
		hash = "86047bb1969d1db455493955fd450d18c62a3f36294d0a6c3732c88dfbcc4f62"
		hash = "06c5ebd0371342d18bc81a96f5e5ce28de64101e3c2fd0161d0b54d8368d2f1f"
		hash = "4734a0a5d88f44a4939b8d812364cab6ca5f611b9b8ceebe27df6c1ed3a6d8a4"
		hash = "770f33259d6fb10f4a32d8a57d0d12953e8455c72bb7b60cb39ce505c507013a"
		hash = "50819a1add4c81c0d53203592d6803f[PII_REDACTED]35ff8260ff3b6d5253c0c76"
		hash = "f9f2091fccb289bcf6a945f6b38676ec71dedb32f[PII_REDACTED]ccaf840ca131a"
		hash = "fa9abb3e7e06f857be191a1e049dd37642ec41fb2520c105df2227fcac3de5d5"
		hash = "139f8412a7c6fdc43dcfbbcdba256ee55654eb36a40f338249d5162a1f69b988"
		hash = "e1cb86386757b947b39086cc8639da988f6e8018ca9995dd669bdc03c8d39d7d"
		hash = "e6f764c3b5580cd1675cbf184938ad5a201a8c[PII_REDACTED]69bd7c3399df0d12"
		hash = "bb2422e96ea993007f25c71d55b2eddfa1e940c89e895abb50dd07d7c17ca1df"
		date = "2024-08-07"
		score = 70
		id = "05060e37-3c01-5b86-a3ee-6e141399164a"
	strings:
		$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]006f006e[1-8][PII_REDACTED]6e0064006f[PII_REDACTED][PII_REDACTED][PII_REDACTED]730079006d0062006f006c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0072 } /* FileDescription WindowsGUIsymbolicdebugger */
		$ = { 0043006f006d[PII_REDACTED]6e0079004e0061006d0065[1-8]004d0069