LOLDrivers high experimental sigma

Driver Load - ACE-BASE.sys

Detects loading of driver ACE-BASE.sys via hash. Allows privilege escalation from regular user to System or PPL

View Source

Detection Logic

{
  "selection_hashes": {
    "Hashes
| contains": [
      "MD5=e8f177545acc656c837b74102cd76527",
      "SHA1=39402a9a3d90ba62938052089c8cbde9fb4e639f",
      "SHA256=7326aefff9ea3a32286b423a62baebe33b73251348666c1ee569afe62dd60e11",
      "IMPHASH=13ad56e7c65468e58c468f56e33687d4"
    ]
  },
  "condition": "selection_hashes"
}

False Positives

  • ⚠ Unknown

Field Validations

Loading…

Comments (0)

Loading comments...