LOLDrivers high experimental sigma

Driver Load - 2.sys

Detects loading of driver 2.sys via hash. Driver categorized as POORTRY by Mandiant.

View Source

Detection Logic

{
  "selection_hashes": {
    "Hashes
| contains": [
      "MD5=bd25be845c151370ff177509d95d5add",
      "SHA1=10115219e3595b93204c70eec6db3e68a93f3144",
      "SHA256=88076e98d45ed3adf0c5355411fe8ca793eb7cec1a1c61f5e1ec337eae267463",
      "IMPHASH=3fd33d5b3b52e2db91983ac4b1d7a3c4"
    ]
  },
  "condition": "selection_hashes"
}

False Positives

  • ⚠ Unknown

Field Validations

Loading…

Comments (0)

Loading comments...