YARA Detection Rule: PUA_VULN_Renamed_Driver_Windowsrcodenamelonghornddkprovider_Cpuzsys_Windowsrcodenamelonghornddkdriver_4932
Repository: Neo23x0/signature-base
Detects: Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - cpuz.sys
Author: Florian Roth
Reference: https://github.com/magicsword-io/LOLDrivers

Pattern signatures:
$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]006f006e[1-8][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]00650072 } /* FileDescription CPUIDDriver */
		$ = { 0043006f006d[PII_REDACTED]6e0079004e0061006d0065[1-8][PII_REDACTED]6e0064006f[PII_REDACTED][PII_REDACTED][PII_REDACTED]43006f[PII_REDACTED]6e0061006d[PII_REDACTED]4c006f006e[PII_REDACTED]6f0072006e[PII_REDACTED]44004b[PII_REDACTED]72006f[PII_REDACTED][PII_REDACTED] } /* CompanyName WindowsRCodenameLonghornDDKprovider */
		$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED]0069006f006e[1-8]0036002e0030002e[PII_REDACTED]300030002e[PII_REDACTED][PII_REDACTED][PII_REDACTED]750069006c[PII_REDACTED]620079003a[PII_REDACTED]69006e[PII_REDACTED]4b } /* FileVersion builtbyWinDDK */
		$ = {[PII_REDACTED]6f[PII_REDACTED][PII_REDACTED][PII_REDACTED]730069006f006e[1-8]0036002e0030002e[PII_REDACTED]300030002e[PII_REDACTED][PII_REDACTED] } /* ProductVersion  */
		$ = { 0049006e[PII_REDACTED]72006e0061006c004e0061006d0065[1-8][PII_REDACTED]75007a002e[PII_REDACTED]73 } /* InternalName cpuzsys */
		$ = {[PII_REDACTED]6f[PII_REDACTED]630074004e0061006d0065[1-8][PII_REDACTED]6e0064

Detection condition:
uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /cpuz/i

Full rule:
rule PUA_VULN_Renamed_Driver_Windowsrcodenamelonghornddkprovider_Cpuzsys_Windowsrcodenamelonghornddkdriver_4932 {
	meta:
		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - cpuz.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "49329fa09f584d1960b09c1b15df18c0bc1c4fdb90bf48b6b5703e872040b668"
		hash = "84c5f6ddd9c90de873236205b59921caabb57ac6f7a506abbe2ce188833bbe51"
		hash = "8e92aacd60fca1f09b7257e62caf0692794f5d741c5d1eec89d841e87f2c359c"
		hash = "2ef7df384e93951893b65500dac6ee09da6b8fe9128326caad41b8be4da49a1e"
		hash = "ac1af529c9491644f1bda63267e0f0f35e30ab0c98ab1aecf4571f4190ab9db4"
		hash = "dbb457ae1bd07a945a1466ce4a206c625e590aee3922fa7d86fbe956beccfc98"
		hash = "8e5aef7c66c0e92dfc037ee29ade1c8484b8d7fadebdcf521d2763b1d8215126"
		hash = "79440da6b8178998bdda5ebde90491c124b1967d295db1449ec820a85dc246dd"
		hash = "6001c6acae09d2a91f8773bbdfd52654c99bc672a9756dc4cb53dc2e3efeb097"
		date = "2024-08-07"
		score = 70
		id = "82418e8e-31cb-5499-9263-f0edc2d2b1e7"
	strings:
		$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]006f006e[1-8][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]00650072 } /* FileDescription CPUIDDriver */
		$ = { 0043006f006d[PII_REDACTED]6e0079004e0061006d0065[1-8][PII_REDACTED]6e0064006f[PII_REDACTED][PII_REDACTED][PII_REDACTED]43006f[PII_REDACTED]6e0061006d[PII_REDACTED]4c006f006e[PII_REDACTED]6f0072006e[PII_REDACTED]44004b[PII_REDACTED]72006f[PII_REDACTED][PII_REDACTED] } /* CompanyName WindowsRCodenameLonghornDDKprovider */
		$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED]0069006f006e[1-8]0036002e0030002e[PII_REDACTED]300030002e[PII_REDACTED][PII_REDACTED][PII_REDACTED]750069006c[PII_REDACTED]620079003a[PII_REDACTED]69006e[PII_REDACTED]4b } /* FileVersion builtbyWinDDK */
		$ = {[PII_REDACTED]6f[PII_REDACTED][PII_REDACTED][PII_REDACTED]730069006f006e[1-8]0036002e0030002e[PII_REDACTED]300030002e[PII_REDACTED][PII_REDACTED] } /* ProductVersion  */
		$ = { 0049006e[PII_REDACTED]72006e0061006c004e0061006d0065[1-8][PII_REDACTED]75