Hayabusa informational stable sigma

Failed Code Integrity Checks

Detects code integrity failures such as missing page hashes or corrupted drivers due unauthorized modification. This could be a sign of tampered binaries.

View Source

Detection Logic

{
  "security": {
    "Channel": "Security"
  },
  "selection": {
    "EventID": [
      5038,
      6281
    ]
  },
  "filter_optional_crowdstrike": {
    "param1
| contains": [
      "\\CSFalconServiceUninstallTool_",
      "\\Program Files\\CrowdStrike\\",
      "\\System32\\drivers\\CrowdStrike\\",
      "\\Windows\\System32\\ScriptControl64_"
    ]
  },
  "filter_optional_sophos": {
    "param1
| contains": "\\Program Files\\Sophos\\"
  },
  "condition": "security and (selection and not 1 of filter_optional_*)"
}

False Positives

⚠ Disk device errors

Field Validations

Loading…

Comments (0)

Loading comments...