Windows_VulnDriver_Biostar_b98e13a3

rule Windows_VulnDriver_Biostar_b98e13a3 {
    meta:
        author = "Elastic Security"
        id = "b98e13a3-03f2-4d75-b8ae-183643f467de"
        fingerprint = "b1ef9b5fe9b546066319a4e5472cc78a367a119e70f0995fb7285c9b5d007659"
        creation_date = "2026-05-22"
        last_modified = "2026-06-25"
        description = "Subject: Biostar Microtech Int'l Corp"
        threat_name = "Windows.VulnDriver.Biostar"
        reference_sample = "362c4f3dadc9c393682664a139d65d80e32caa2a97b6e0361dfd713a73267ecc"
        severity = 50
        arch_context = "x86"
        scan_context = "file"
        license = "Elastic License v2"
        os = "windows"
    strings:
        $subject_name = { 06 03 55 04 03 [2] 42 69 6F 73 74 61 72 20 4D 69 63 72 6F 74 65 63 68 20 49 6E 74 27 6C 20 43 6F 72 70 }
        $str1 = "BS_RCIO.pdb"
    condition:
        int16(uint32(0x3C) + 0x5c) == 0x0001 and $subject_name and $str1
}