Driver Installer-unlock Tool.exe: ((exclusive))

rule DriverUnlocker_Backdoor meta: description = "Detects driver installer-unlock tool.exe" author = "Security Research Team" strings: $s1 = "Driver Signature Enforcement unlocked" wide ascii $s2 = "NtSetSystemInformation" fullword ascii $s3 = "WindrvrSupport" fullword ascii $hash = 4F 3A 2C 1B 0E 9F 8D 7C condition: uint16(0) == 0x5A4D and ($s1 or $s2 or $s3) and $hash at pe.section_index(".text")

It modifies keys under: