Windows_VulnDriver_WinIo_837e6da3

rule Windows_VulnDriver_WinIo_837e6da3 {
    meta:
        author = "Elastic Security"
        id = "837e6da3-0b81-4ee5-800c-76f048cf7bc6"
        fingerprint = "64ed3e8b27470e40f42ddec58b48e5ec63c01ec1583dc12eadaeb7998b6793d0"
        creation_date = "2026-07-21"
        last_modified = "2026-08-11"
        description = "Subject: WDKTestCert heavenluo,131620253795976757"
        threat_name = "Windows.VulnDriver.WinIo"
        reference_sample = "eaaed21c1788baca09ee16b06e1a231cb11c8417b3949d7d90596d50305dc604"
        severity = 50
        arch_context = "x86"
        scan_context = "file"
        license = "Elastic License v2"
        os = "windows"
    strings:
        $subject_name = { 06 03 55 04 03 [2] 57 44 4B 54 65 73 74 43 65 72 74 20 68 65 61 76 65 6E 6C 75 6F 2C 31 33 31 36 32 30 32 35 33 37 39 35 39 37 36 37 35 37 }
        $str1 = "D:\\Users\\heavenluo\\Documents\\Visual Studio 2017\\Projects\\WinIo\\x64\\Release\\WinIo64.pdb"
        $seq1 = { 48 8D 05 99 02 00 00 48 89 87 E0 00 00 00 48 8D 15 F3 08 00 00 48 89 87 80 00 00 00 48 8D 4C 24 50 48 89 47 70 }
    condition:
        int16(uint32(0x3C) + 0x5c) == 0x0001 and int16(uint32(0x3C) + 0x18) == 0x020b and $subject_name and $str1 and $seq1
}