LOLDrivers high experimental sigma

Driver Load - 1109.sys

Detects loading of driver 1109.sys via hash. 1109.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.

View Source

Detection Logic

{
  "selection_hashes": {
    "Hashes
| contains": [
      "MD5=41c580714dd28bda7da36dc5dc660710",
      "SHA1=9b4052df235ba8e17874c6b1c57130d619f87432",
      "SHA256=f154167b4b92851f478b3c3f88423cd719e3139bac5da07f33dd7929796c96f5",
      "IMPHASH=4967091397a11c6325fd38bc55575f63"
    ]
  },
  "condition": "selection_hashes"
}

False Positives

  • ⚠ Unknown

Field Validations

Loading…

Comments (0)

Loading comments...