LOLDrivers high experimental sigma

Driver Load - ADV64DRV.sys

Detects loading of driver ADV64DRV.sys via hash.

View Source

Detection Logic

{
  "selection_hashes": {
    "Hashes
| contains": [
      "MD5=778b7feea3c750d44745d3bf294bd4ce",
      "SHA1=2261198385d62d2117f50f631652eded0ecc71db",
      "SHA256=04a85e359525d662338cae86c1e59b1d7aa9bd12b920e8067503723dc1e03162",
      "IMPHASH=1d9cdf46ff335712634c292180c06755"
    ]
  },
  "condition": "selection_hashes"
}

False Positives

  • ⚠ Unknown

Field Validations

Loading…

Comments (0)

Loading comments...