YARA Detection Rule: PUA_VULN_Renamed_Driver_Highresolutionenterpriseswwwhighrezcouk_Inpoutsys_Inpoutdriverversion_CFAB
Repository: Neo23x0/signature-base
Detects: Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - inpout32.sys
Author: Florian Roth
Reference: https://github.com/magicsword-io/LOLDrivers

Pattern signatures:
$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]006f006e[1-8]004b[PII_REDACTED]6e0065006c0020006c[PII_REDACTED]65006c[PII_REDACTED]6f[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0072 } /* FileDescription Kernellevelportaccessdriver */
		$ = { 0043006f006d[PII_REDACTED]6e0079004e0061006d0065[1-8][PII_REDACTED][PII_REDACTED][PII_REDACTED]6f006c[PII_REDACTED]69006f006e[PII_REDACTED]6e[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]005b[PII_REDACTED]77002e[PII_REDACTED][PII_REDACTED]0065007a002e0063006f002e0075006b005d } /* CompanyName HighresolutionEnterpriseswwwhighrezcouk */
		$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED]0069006f006e[1-8]0031002e[PII_REDACTED][PII_REDACTED]006c[PII_REDACTED]620079003a[PII_REDACTED]69006e[PII_REDACTED]4b } /* FileVersion builtbyWinDDK */
		$ = {[PII_REDACTED]6f[PII_REDACTED][PII_REDACTED][PII_REDACTED]730069006f006e[1-8]0031002e0032 } /* ProductVersion  */
		$ = { 0049006e[PII_REDACTED]72006e0061006c004e0061006d0065[1-8]0069006e0070006f[PII_REDACTED]330032002e[PII_REDACTED]73 } /* InternalName inpoutsys */
		$ = {[PII_REDACTED]6f[PII_REDACTED]6

Detection condition:
uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /inpout32/i

Full rule:
rule PUA_VULN_Renamed_Driver_Highresolutionenterpriseswwwhighrezcouk_Inpoutsys_Inpoutdriverversion_CFAB {
	meta:
		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - inpout32.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "cfab93885e5129a86d13fd380d010cc8c204429973b776ab1b472d84a767930f"
		hash = "945ee05244316ff2f877718cf0625d4eb34e6ec472f403f958f2a700f9092507"
		hash = "7db320e49139f636c8b6d12b6c78b666a62599e9d59587ba87c6b89b0a34b18d"
		hash = "16360ead229b13deb47bc2bef40f282474c9f18c213c636cdfb8cc[PII_REDACTED]"
		hash = "b8ded5e10dfc997482ba4377c60e7902e6f755674be51b0e181ae465529fb2f2"
		date = "2024-08-07"
		score = 70
		id = "106dd762-a6d5-5bb0-bb11-b54cf0fc03a7"
	strings:
		$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]006f006e[1-8]004b[PII_REDACTED]6e0065006c0020006c[PII_REDACTED]65006c[PII_REDACTED]6f[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0072 } /* FileDescription Kernellevelportaccessdriver */
		$ = { 0043006f006d[PII_REDACTED]6e0079004e0061006d0065[1-8][PII_REDACTED][PII_REDACTED][PII_REDACTED]6f006c[PII_REDACTED]69006f006e[PII_REDACTED]6e[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]005b[PII_REDACTED]77002e[PII_REDACTED][PII_REDACTED]0065007a002e0063006f002e0075006b005d } /* CompanyName HighresolutionEnterpriseswwwhighrezcouk */
		$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED]0069006f006e[1-8]0031002e[PII_REDACTED][PII_REDACTED]006c[PII_REDACTED]620079003a[PII_REDACTED]69006e[PII_REDACTED]4b } /* FileVersion builtbyWinDDK */
		$ = {[PII_REDACTED]6f[PII_REDACTED][PII_REDACTED][PII_REDACTED]730069006f006e[1-8]0031002e0032 } /* ProductVersion  */
		$ = { 0049006e[PII_REDACTED]72006e0061006c004e0061006d0065[1-8]0069006e0070006f[PII_REDACTED]330032002e[PII_REDACTED]73 } /* InternalName inpoutsys */
		$ = {[PII_REDACTED]6f[PII_REDACTED]630074004e0061006d0065[1-8]0069006e0070006f[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]6f006e[PII_REDACTED]2e0032 } /* ProductName inpoutDriverVersion */
		$ = { 00