PUA_VULN_Renamed_Driver_Geintelligentplatformsinc_Gedevicedriver_Proficymachineedition_Build_CAC5

rule PUA_VULN_Renamed_Driver_Geintelligentplatformsinc_Gedevicedriver_Proficymachineedition_Build_CAC5 {
	meta:
		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - GEDevDrv.SYS"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "cac5dc7c3da69b682097144f12a816530091d4708ca432a7ce39f6abe6616461"
		hash = "51145a3fa8258aac106f65f34159d23c54b48b6d54ec0421748b3939ab6778eb"
		date = "2024-08-07"
		score = 70
		id = "eb1e48ac-37d2-544a-890f-6731567c0d0e"
	strings:
		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0047004500200044006500760069006300650020004400720069007600650072 } /* FileDescription GEDeviceDriver */
		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0047004500200049006e00740065006c006c006900670065006e007400200050006c006100740066006f0072006d0073002c00200049006e0063002e } /* CompanyName GEIntelligentPlatformsInc */
		$ = { 00460069006c006500560065007200730069006f006e[1-8]0037002e0030003000200028004200750069006c0064002000350035003100370029 } /* FileVersion Build */
		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0037002e0030003000200028004200750069006c0064002000350035003100370029 } /* ProductVersion Build */
		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0047004500200044006500760069006300650020004400720069007600650072 } /* InternalName GEDeviceDriver */
		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500072006f00660069006300790020004d0061006300680069006e0065002000450064006900740069006f006e } /* ProductName ProficyMachineEdition */
		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00470045004400650076004400720076002e005300590053 } /* OriginalFilename GEDevDrvSYS */
		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a900200032003000310031002c00200047004500200049006e00740065006c006c006900670065006e007400200050006c006100740066006f0072006d0073002c00200049006e0063002e } /* LegalCopyright GEIntelligentPlatformsInc */
	condition:
		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /GEDevDrv/i
}