Windows_VulnDriver_WinIo_6ab5231b

rule Windows_VulnDriver_WinIo_6ab5231b {
    meta:
        author = "Elastic Security"
        id = "6ab5231b-14f8-48e6-9040-803b45611e7b"
        fingerprint = "e85a611c721e787e6f1adce4f2a7c8d4c24b516de210c7d60be3389edd01eef8"
        creation_date = "2026-05-22"
        last_modified = "2026-07-29"
        description = "Subject: 上海弘玑信息技术有限公司"
        threat_name = "Windows.VulnDriver.WinIo"
        reference_sample = "385660a65e69b3bf9ac5c2ae4cadbb1e07f366e1807979bf7a915e40e9480f8b"
        severity = 50
        arch_context = "x86"
        scan_context = "file"
        license = "Elastic License v2"
        os = "windows"
    strings:
        $subject_name = { 06 03 55 04 03 [2] E4 B8 8A E6 B5 B7 E5 BC 98 E7 8E 91 E4 BF A1 E6 81 AF E6 8A 80 E6 9C AF E6 9C 89 E9 99 90 E5 85 AC E5 8F B8 }
        $str1 = "WinIo.pdb"
    condition:
        int16(uint32(0x3C) + 0x5c) == 0x0001 and int16(uint32(0x3C) + 0x18) == 0x020b and $subject_name and $str1
}