LOLDrivers high experimental sigma

Driver Load - AsusSAIO.sys

Detects loading of driver AsusSAIO.sys via hash. ASUS System Analysis IO drivers affected by CVE-2024-55408 expose privileged hardware operations through the \\Device\\ASUSSAIO interface. This 1.0.1.0 build accepts FILE_ANY_ACCESS IOCTLs, including 0x80102074 and 0x80102078, that map caller-selected physical addresses with MmMapIoSpace for read and write operations. The interface also exposes direct I/O-port access without a caller-token authorization check, allowing a local user to cross the user-to-kernel security boundary.

View Source

Detection Logic

{
  "selection_hashes": {
    "Hashes
| contains": [
      "MD5=8b9c06294510f07360e20bafc26813cf",
      "SHA1=1b06d83f6cca14563fe2cd3da2ba6e0f90942353",
      "SHA256=2d1c04a9ee1664c25574048363620800482a89e1c99f4338dc252038aa949419",
      "IMPHASH=1ac96b4270f0fe700cb9a3d755426cea"
    ]
  },
  "condition": "selection_hashes"
}

False Positives

⚠ Unknown

Field Validations

Loading…

Comments (0)

Loading comments...