Hayabusa high test sigma

HackTool - NoFilter Execution

Detects execution of NoFilter, a tool for abusing the Windows Filtering Platform for privilege escalation via hardcoded policy name indicators

View Source

Detection Logic

{
  "security": {
    "Channel": "Security"
  },
  "selection_5447": {
    "EventID": 5447,
    "FilterName
| contains": "RonPolicy"
  },
  "selection_5449": {
    "EventID": 5449,
    "ProviderContextName
| contains": "RonPolicy"
  },
  "condition": "security and (1 of selection_*)"
}

False Positives

  • ⚠ Unknown

Field Validations

Loading…

Comments (0)

Loading comments...