{"Id":"e7c958da-fd5d-40d6-975e-582c6fee7f69","Tags":["BS_RCIO64.sys"],"Verified":"TRUE","Author":"Michael Haag","Created":"2023-01-09","MitreID":"T1068","Category":"vulnerable driver","Commands":{"Command":"sc.exe create BS_RCIO64.sys binPath=C:\\windows\\temp\\BS_RCIO64.sys type=kernel && sc.exe start BS_RCIO64.sys","Description":"BIOSTAR BS_RCIO64_W10 exposes IOCTLs 0x226004 and 0x226008 that map caller-selected physical addresses with MmMapIoSpace and read from or write to the mapped range. Additional IOCTLs expose raw port and PCI configuration access, providing privileged hardware-control primitives suitable for kernel tampering.","OperatingSystem":"Windows 10","Privileges":"kernel","Usecase":"Elevate privileges"},"Resources":["https://github.com/jbaines-r7/dellicious","https://www.rapid7.com/blog/post/2021/12/13/driver-based-attacks-past-and-present/","https://github.com/elastic/protections-artifacts/blob/932baf346cc8a743f1963ad3d4565b42ed17bebe/yara/rules/Windows_VulnDriver_Biostar.yar#L54","https://nephosec.com/cve-biostar-exploit/","https://github.com/fluffycats31/vulnerable-drivers"],"Detection":[{"type":"yara_signature","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/d205286bffdf09bc033c09e95c519c1c267b40c2ee8bab703c6a2d86741ccd3e.yara"},{"type":"sigma_hash","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"},{"type":"sigma_names","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"},{"type":"sysmon_hash_detect","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"},{"type":"sysmon_hash_block","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"},{"type":"yara_signature","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"},{"type":"sigma_hash","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"},{"type":"sigma_names","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"},{"type":"sysmon_hash_detect","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"},{"type":"sysmon_hash_block","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"}],"Acknowledgement":{"Handle":"@fluffycats31","Person":"fluffycats31"},"KnownVulnerableSamples":[{"Authentihash":{"MD5":"380a4fd97d795fec244add19a9c21fd6","SHA1":"6832acd68bcf08f8ced63023b5f7da36824cc596","SHA256":"6991be9952aa08c0d2ac9fa728410ebdb44988b496ed01b8b7f478785ebb30c4"},"Company":"BIOSTAR Group","Copyright":"Copyright (c) 2018-2019 BIOSTAR Group","CreationTimestamp":"2019-01-10 21:06:10","Date":"","Description":"I/O Interface driver file","ExportedFunctions":"","FileVersion":"10.0.1901.1100","Filename":"BS_RCIO64.sys","ImportedFunctions":["KeInitializeSemaphore","IoCreateSymbolicLink","IoCreateDevice","KeSetEvent","MmUnmapIoSpace","KeDelayExecutionThread","PsCreateSystemThread","IoStartNextPacket","PsTerminateSystemThread","ExEventObjectType","MmMapIoSpace","IoDeleteDevice","ObReferenceObjectByHandle","KeWaitForSingleObject","KeReleaseSemaphore","ObfDereferenceObject","IoReleaseCancelSpinLock","IoAcquireCancelSpinLock","IoStartPacket","IofCompleteRequest","KeRemoveEntryDeviceQueue","KeBugCheckEx","RtlInitUnicodeString","ZwClose","IoDeleteSymbolicLink","HalSetBusDataByOffset","HalGetBusDataByOffset"],"Imports":["ntoskrnl.exe","HAL.dll"],"InternalName":"I/O driver","MD5":"b10b210c5944965d0dc85e70a0b19a42","MachineType":"AMD64","MagicHeader":"50 45 0 0","OriginalFilename":"BS_RCIO64.sys","Product":"BIOSTAR I/O driver","ProductVersion":"10.0.1901.1100","Publisher":"","RichPEHeaderHash":{"MD5":"fa3d25060a1ec2f8199a8bba2d045991","SHA1":"ad2b349c74d3ed46f9becdf406543a042bc9aa42","SHA256":"248bdbea478bce55d40dfffeec5d164dd8018c12791b03ef33306faa402a261c"},"SHA1":"5db61d00a001fd493591dc919f69b14713889fc5","SHA256":"d205286bffdf09bc033c09e95c519c1c267b40c2ee8bab703c6a2d86741ccd3e","Sections":{".text":{"Entropy":6.431562553318975,"Virtual Size":"0x23a8"},".rdata":{"Entropy":4.706103981422025,"Virtual Size":"0x2b0"},".data":{"Entropy":0.43605306823188833,"Virtual Size":"0x14c"},".pdata":{"Entropy":3.811817272023083,"Virtual Size":"0x168"},"INIT":{"Entropy":5.343740869583082,"Virtual Size":"0x550"},".rsrc":{"Entropy":3.3065491006589522,"Virtual Size":"0x410"}},"Signature":["Microsoft Windows Hardware Compatibility Publisher","Microsoft Windows Third Party Component CA 2014","Microsoft Root Certificate Authority 2010"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher","ValidFrom":"2018-09-06 21:30:32","ValidTo":"2019-09-06 21:30:32","Signature":"a5a2a99a97df110e18898e98fd07aaa52616e13f9c681d0f99cbafcb2914dd7a56a8324ab1fa926b26b9c5c87fd653c193cac3773f7750425d2090034461012f476d77005a079f2883e4cfa8b1dbab735f086c9692b3f6f53efb5db881bd94cdbda4c4c9597026a8fbf1eed41bf628879156fcacae96e751d4fe117f0f6dc985ef3bd72a7bd299bd507633600c9df2f92306fe4833a8d784019dbe8baaaa06fddae1d5066677c9bcce6506e6ebe455cc9f46b1e6e9d77f2a82159b2aac861eeb400de3dcef2bdfa85e0dc51628945f14b3f44340ba9f2a3af7ef1bf24f372b3a0d0fef4baafb86cf3ba43f29030b891d4b46b4ccb29b00506dc0ee0e44959f8369fc9e0fd4bc5fa12159a4cd6db8f9af57353c132654278784509635cf5e020c43757525a4d3dcbbd532986b46b2efaa2b6b3a00aa8d44cd0546efddb6ab2e30ccf75aba4bc8d9249262e408516b89cdd58c55b9af18baeb0201f7732724b4d3ca0c74ebc4afa19bb5583f948e9619232ece825e09465fdab93f6fe6ed0590d08435879ac1ba3cf41a8c4a8f5fea6a50e84a21a5ca38414e85de3867f4bce967cb45b62335b7416a0fdc08c1e3c049e85ef944f438e5f1296a659ff8e01a170001751f92b395bd7c9b4f33106a708a005c16c2b5439bac392253e1bcfbcb545d5f6243466205655a2e496098b9045d605b632b8f98d29f51e27e62fe63a4e8f2","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"33000000253a2738690a3451c1000000000025","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"60cb2d8488f8724a67bf3254e6a57ff1","SHA1":"37aef77a1afaa33ac5787fc43a2c1e2509a19eb1","SHA256":"495a6ff7ace92f915eb1753c4c0b32612056e6d320bb17ff90346db3aa357432","SHA384":"2a90dcf67abc92f070775de78ecf066e7730ea57b4c4d6c64cfdd66c3eb0f639ac188b24571a9f600ef017737a71decf"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","ValidFrom":"2014-10-15 20:31:27","ValidTo":"2029-10-15 20:41:27","Signature":"96b5c33b31f27b6ba11f59dd742c3764b1bca093f9f33347e9f95df21d89f4579ee33f10a3595018053b142941b6a70e5b81a2ccbd8442c1c4bed184c2c4bd0c8c47bcbd8886fb5a0896ae2c2fdfbf9366a32b20ca848a6945273f732332936a23e9fffdd918edceffbd6b41738d579cf8b46d499805e6a335a9f07e6e86c06ba8086725afc0998cdba7064d4093188ba959e69914b912178144ac57c3ae8eae947bcb3b8edd7ab4715bba2bc3c7d085234b371277a54a2f7f1ab763b94459ed9230cce47c099212111f52f51e0291a4d7d7e58f8047ff189b7fd19c0671dcf376197790d52a0fbc6c12c4c50c2066f50e2f5093d8cafb7fe556ed09d8a753b1c72a6978dcf05fe74b20b6af63b5e1b15c804e9c7aa91d4df72846782106954d32dd6042e4b61ac4f24636de357302c1b5e55fb92b59457a9243d7c4e963dd368f76c728caa8441be8321a66cde5485c4a0a602b469206609698dcd933d721777f886dac4772daa2466eab64682bd24e98fb35cc7fec3f136d11e5db77edc1c37e1f6a4a14f8b4a721c671866770cdd819a35d1fa09b9a7cc55d4d728e74077fa74d00fcdd682412772a557527cda92c1d8e7c19ee692c9f7425338208db38cc7cc74f6c3a6bc237117872fe55596460333e2edfc42de72cd7fb0a82256fb8d70c84a5e1c4746e2a95329ea0fecdb4188fd33bad32b2b19ab86d0543fbff0d0f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"330000000d690d5d7893d076df00000000000d","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"83f69422963f11c3c340b81712eef319","SHA1":"0c5e5f24590b53bc291e28583acb78e5adc95601","SHA256":"d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae","SHA384":"260ad59ba706420f68ba212931153bd89f760c464b21be55fba9d014fff322407859d4ebfb78ea9a3330f60dc9821a63"}}],"Signer":[{"SerialNumber":"33000000253a2738690a3451c1000000000025","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","Version":1}]}],"Imphash":"095c0cdb9c0421da216371c1f4e8790e","LoadsDespiteHVCI":"FALSE"},{"Filename":"BS_RCIO64_W10.sys","MD5":"83f77a67e70733496fde17a1792fa33b","SHA1":"9ffb0e96d1354b04533c70af6c8cd2cbfa5e5db3","SHA256":"7c6f16af074c3f1c74fc69734f1c8b8a03b0594ac2085d5a0c582fc8cc378858","LoadsDespiteHVCI":"FALSE","Imphash":"095c0cdb9c0421da216371c1f4e8790e","Authentihash":{"MD5":"327031c34a1a13c823de2a708f8ebb52","SHA1":"c52a0178c9705949a6ec200543ea500e1bcf4f9b","SHA256":"41e0ceb69b3725bb0f8ae5ed94d81cd19e3775785e8f6f42523cb13250569baa"},"RichPEHeaderHash":{"MD5":"fa3d25060a1ec2f8199a8bba2d045991","SHA1":"ad2b349c74d3ed46f9becdf406543a042bc9aa42","SHA256":"248bdbea478bce55d40dfffeec5d164dd8018c12791b03ef33306faa402a261c"},"Sections":{".text":{"Entropy":6.381094875218638,"Virtual Size":"0x1e18"},".rdata":{"Entropy":4.640113825634233,"Virtual Size":"0x29c"},".data":{"Entropy":0.43605306823188833,"Virtual Size":"0x14c"},".pdata":{"Entropy":3.8133924390072353,"Virtual Size":"0x12c"},"INIT":{"Entropy":5.346918961721454,"Virtual Size":"0x550"},".rsrc":{"Entropy":3.4069558429176126,"Virtual Size":"0x420"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2018-06-22 01:45:07","Description":"I/O Interface driver file","Company":"BIOSTAR Group","InternalName":"I/O driver","OriginalFilename":"BS_RCIO64_W10.sys","FileVersion":"10, 0, 1806, 2200","Product":"BIOSTAR I/O driver","ProductVersion":"10, 0, 1806, 2200","Copyright":"Copyright (c) 2018-2019 BIOSTAR Group","MachineType":"AMD64","Imports":["ntoskrnl.exe","HAL.dll"],"ExportedFunctions":"","ImportedFunctions":["KeInitializeSemaphore","IoCreateSymbolicLink","IoCreateDevice","KeSetEvent","MmUnmapIoSpace","KeDelayExecutionThread","PsCreateSystemThread","IoStartNextPacket","PsTerminateSystemThread","ExEventObjectType","MmMapIoSpace","IoDeleteDevice","ObReferenceObjectByHandle","KeWaitForSingleObject","KeReleaseSemaphore","ObfDereferenceObject","IoReleaseCancelSpinLock","IoAcquireCancelSpinLock","IoStartPacket","IofCompleteRequest","KeRemoveEntryDeviceQueue","KeBugCheckEx","RtlInitUnicodeString","ZwClose","IoDeleteSymbolicLink","HalSetBusDataByOffset","HalGetBusDataByOffset"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher","ValidFrom":"2017-10-05 17:44:16","ValidTo":"2018-10-05 17:44:16","Signature":"5d029dd2c0ca0f997555ec89434d33899bd9a1ed711df775386647a579200c20df265adea863cc62d7e52425677abd190bf3717a12cd237961cdb74793930af7d63c57e4b868dbe09b8f03604a5a2e2b7fda4f9210aca193758f848d353f68f5913887c6e286a88519db9258401e939a2b541ea2b970460afa999f9fd26ba5b7c109d1088a3c2d42873691ff2ccb482289205190d0349c1f5b559f5f84e2bfa45e0152111d2c54ccd7d6212c50b5de6f0add83776bc70b319a108076fde4973d281e0f020f33dd8f7d57501216c6499d40dd8ac64566a564fee1abf5d3667d3b9bc9c904dfba7c0ca42b0d8267b16e8fe257f11c45f2fbe2d9bba0f688d12c4ffb563b68fc1e8be829f600829c49fdac4f757ea24e774d000ef3caa359f1a34ef54c77a3c0c11fc3a5849efd089b301356ff4c88a811abfdadeac18a64f61ea2d79146c18c0d3f066abc0b0fa9e803a8a3e99a960be0c4b40a7a36a7d2880ff89a17f7db91181f67dd134ae7751ac0bcdf047c262834fe3ad8ca28e2f74c3ad7f370b6f184fb58001f1b12c1aa214117f3b253162d2a29a5096d6620324c63c5e32a3cf7384664a09a978dbbebe0b6e34d1aaa1b959e620b0e37750322453dcd172537bd90717c9c9508ad1f3b9281091562c62a2a3004b89d35ee7cb6ea1927b32ffac4bdeaa1b596c5a136e0dd4498fbd3c3a6f17c4ee2668ab03229a4a013","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"330000001f9800c911029569be00000000001f","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"adc809facabcdfc353d4e5d9f8956845","SHA1":"ec1181c8eafabeee4ba13edd8f260a880474b665","SHA256":"cca1b4b3969e9dc0065cfa36ee48648341771a5af94db2d51320d6352c16c85b","SHA384":"a2dfd2d0ad5b27d66da28e972c313ebc2395004638dc6344fafd26d79735359f7562d273b7dbacf6ab294a913a20cd0b"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","ValidFrom":"2014-10-15 20:31:27","ValidTo":"2029-10-15 20:41:27","Signature":"96b5c33b31f27b6ba11f59dd742c3764b1bca093f9f33347e9f95df21d89f4579ee33f10a3595018053b142941b6a70e5b81a2ccbd8442c1c4bed184c2c4bd0c8c47bcbd8886fb5a0896ae2c2fdfbf9366a32b20ca848a6945273f732332936a23e9fffdd918edceffbd6b41738d579cf8b46d499805e6a335a9f07e6e86c06ba8086725afc0998cdba7064d4093188ba959e69914b912178144ac57c3ae8eae947bcb3b8edd7ab4715bba2bc3c7d085234b371277a54a2f7f1ab763b94459ed9230cce47c099212111f52f51e0291a4d7d7e58f8047ff189b7fd19c0671dcf376197790d52a0fbc6c12c4c50c2066f50e2f5093d8cafb7fe556ed09d8a753b1c72a6978dcf05fe74b20b6af63b5e1b15c804e9c7aa91d4df72846782106954d32dd6042e4b61ac4f24636de357302c1b5e55fb92b59457a9243d7c4e963dd368f76c728caa8441be8321a66cde5485c4a0a602b469206609698dcd933d721777f886dac4772daa2466eab64682bd24e98fb35cc7fec3f136d11e5db77edc1c37e1f6a4a14f8b4a721c671866770cdd819a35d1fa09b9a7cc55d4d728e74077fa74d00fcdd682412772a557527cda92c1d8e7c19ee692c9f7425338208db38cc7cc74f6c3a6bc237117872fe55596460333e2edfc42de72cd7fb0a82256fb8d70c84a5e1c4746e2a95329ea0fecdb4188fd33bad32b2b19ab86d0543fbff0d0f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"330000000d690d5d7893d076df00000000000d","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"83f69422963f11c3c340b81712eef319","SHA1":"0c5e5f24590b53bc291e28583acb78e5adc95601","SHA256":"d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae","SHA384":"260ad59ba706420f68ba212931153bd89f760c464b21be55fba9d014fff322407859d4ebfb78ea9a3330f60dc9821a63"}}],"Signer":[{"SerialNumber":"330000001f9800c911029569be00000000001f","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","Version":1}]}]}]}