LOLDrivers high experimental sigma

Driver Load - 7.sys

Detects loading of driver 7.sys via hash. Driver categorized as POORTRY by Mandiant.

View Source

Detection Logic

{
  "selection_hashes": {
    "Hashes
| contains": [
      "MD5=dc564bac7258e16627b9de0ce39fae25",
      "SHA1=0291d0457acaf0fe8ed5c3137302390469ce8b35",
      "SHA256=6839fcae985774427c65fe38e773aa96ec451a412caa5354ad9e2b9b54ffe6c1",
      "IMPHASH=b351627263648b1d220bb488e7ec7202"
    ]
  },
  "condition": "selection_hashes"
}

False Positives

  • ⚠ Unknown

Field Validations

Loading…

Comments (0)

Loading comments...