LOLDrivers low experimental sigma

Driver Load - AsusSAIO.sys

Detects loading of driver AsusSAIO.sys via name. ASUS System Analysis IO drivers affected by CVE-2024-55408 expose privileged hardware operations through the \\Device\\ASUSSAIO interface. This 1.0.1.0 build accepts FILE_ANY_ACCESS IOCTLs, including 0x80102074 and 0x80102078, that map caller-selected physical addresses with MmMapIoSpace for read and write operations. The interface also exposes direct I/O-port access without a caller-token authorization check, allowing a local user to cross the user-to-kernel security boundary.

View Source

Detection Logic

{
  "selection_name": {
    "ImageLoaded
| endswith": [
      "\\asussaio.sys"
    ]
  },
  "condition": "selection_name"
}

False Positives

  • Unknown

Field Validations

Loading…

Comments (0)

Loading comments...