YARA Detection Rule: MAL_Driver_Gentilkiwibenjamindelpy_Mimidrv_Mimidrvmimikatz_7662
Repository: Neo23x0/signature-base
Detects: Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - mimidrv.sys
Author: Florian Roth
Reference: https://github.com/magicsword-io/LOLDrivers

Pattern signatures:
$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]006f006e[1-8]006d0069006d[PII_REDACTED][PII_REDACTED]0066006f[PII_REDACTED]570069006e0064006f[PII_REDACTED]200028006d0069006d0069006b[PII_REDACTED]7a0029 } /* FileDescription mimidrvforWindowsmimikatz */
		$ = { 0043006f006d[PII_REDACTED]6e0079004e0061006d0065[1-8][PII_REDACTED]6e[PII_REDACTED]6c006b[PII_REDACTED][PII_REDACTED][PII_REDACTED]6e006a0061006d0069006e[PII_REDACTED]45004c[PII_REDACTED]29 } /* CompanyName gentilkiwiBenjaminDELPY */
		$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED]0069006f006e[1-8]0032002e0031002e0031002e0030 } /* FileVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED][PII_REDACTED][PII_REDACTED]730069006f006e[1-8]0032002e0031002e0031002e0030 } /* ProductVersion  */
		$ = { 0049006e[PII_REDACTED]72006e0061006c004e0061006d0065[1-8]006d0069006d[PII_REDACTED]720076 } /* InternalName mimidrv */
		$ = {[PII_REDACTED]6f[PII_REDACTED]630074004e0061006d0065[1-8]006d0069006d[PII_REDACTED][PII_REDACTED]0028006d0069006d0069006b[PII_REDACTED]7a0029 } /* ProductName mimidrvmimikatz */
		$ = { 004f[PII_REDACTED]670069006e00

Detection condition:
all of them

Full rule:
rule MAL_Driver_Gentilkiwibenjamindelpy_Mimidrv_Mimidrvmimikatz_7662 {
	meta:
		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - mimidrv.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "7662187c236003308a7951c2f49c0768636c492f8935292d02f69e59b01d236d"
		hash = "a85d3fd59bb492a290552e5124bfe3f9e26a3086d69d42ccc44737b5a66673ec"
		hash = "60ee78a2b070c830fabb54c6bde0d095dff8fad7f72aa719758b3c41c72c2aa9"
		hash = "b2486f9359c94d7473ad8331b87a9c17ca9ba6e4109fd26ce92dff01969eaa09"
		hash = "d41e39215c2c1286e4cd3b1dc0948adefb161f22bc3a78756a027d41614ee4ff"
		hash = "008fa89822b7a1f91e[PII_REDACTED]202ea580f7b06eb6d5cae091ba844d035f25"
		hash = "8206ce9c42582ac980ff5d64f8e3e310bc2baa42d1a206dd831c6ab397fbd8fe"
		hash = "aafa642ca3d[PII_REDACTED]59eeddb6f6b4fe9ad90c6174386cfe13a13e8be47d9"
		hash = "fefc070a5f6a9c0415e1c6f44512a33e8d163024174b30a61423d00d1e8f9bf2"
		hash = "6964a5d85639baee[PII_REDACTED]92861232e75817f93028b50b8c6d34aa38b05b"
		hash = "443c0ba980d4db9213b654a45248fd855855c1cc81d18812cae9d16729ff9a85"
		hash = "e8743094f002239a8a9d6d7852c7852e0bb63cd411b007bd8c194bcba159ef15"
		hash = "ec96b15ce218f97ec1d8f07f13b052d274c4c8438f31daf246ccfaaee5e1bebd"
		hash = "beef40f1b4ce0ff2ee5c264955e6b2a0de6fe[PII_REDACTED]378adc83fad77228b"
		hash = "e858de280bd72d7538386a73e579580a6d5edba87b66b3671dc180229368be19"
		hash = "[PII_REDACTED]9d2a35016e8ca6bd7a1edda25a12702a2294d56010ee8148637f5a"
		hash = "02ebf848fa618eba27065db366b15ee6629d98f551d20612ac38b9f655f37715"
		hash = "40556dd9b79b755cc0b48d3d024ceb15bd2c0e04960062ab2a85cd7d4d1b724a"
		hash = "8b30b2dc36d5e8f1ffc[PII_REDACTED]773fb821cdf66eb6516f82c697a524b599b"
		hash = "2ce4f8089b02017cbe86a5f25d6bc69dd8b6f5060c918a64a4123a5f3be1e878"
		hash = "d7aa8abdda8a68b8418e86bef50c19ef2f34bc66e7b139e43c2a99ab48c933be"
		hash = "82ac05fefaa8c7ee622d11d1a378f1d255b647ab2f3200fd323cc374818a83f2"
		hash = "c7cd14c71bcac5420872c