YARA rule that matches MS HWC signed KmdfLibrary driver PE binaries without Product resource info, like the NetFilter rootkit.

ms_hwc_driver_no_info.yara

import "vt"

rule ms_hwc_sig_kmdf_driver_no_prod_info
{
meta:
  license = "4-Clause BSD"
strings:
    $ms_hwc_serial = { 33 00 00 00 B5 21 3F CA 1E 4A A0 3D E4 00 00 00 00 00 B5 }
    $kmdf_library = "KmdfLibrary" nocase wide ascii
    $prod_name = "ProductName" wide
    $prod_ver = "ProductVersion" wide
condition:
    vt.metadata.new_file and 
    uint16(0) == 0x5a4d and $ms_hwc_serial and not any of ($prod*) and $kmdf_library
}