LOLDrivers low experimental sigma

Driver Load - AMDPowerProfiler.sys

Detects loading of driver AMDPowerProfiler.sys via name. AMD uProf AMDPowerProfiler.sys is affected by CVE-2021-26334. Insufficient access control permits lower-privileged callers to access model-specific registers, which can lead to privilege escalation and ring-0 code execution. AMD addresses the issue in the Windows uProf 3.4.494 release.

View Source

Detection Logic

{
  "selection_name": {
    "ImageLoaded
| endswith": [
      "\\amdpowerprofiler.sys"
    ]
  },
  "condition": "selection_name"
}

False Positives

⚠ Unknown

Field Validations

Loading…

Comments (0)

Loading comments...