LOLDrivers high experimental sigma

Driver Load - amigendrv64.sys

Detects loading of driver amigendrv64.sys via hash.

View Source

Detection Logic

{
  "selection_hashes": {
    "Hashes
| contains": [
      "MD5=32365e3e64d28cc94756ac9a09b67f06",
      "SHA1=d48757b74eff02255f74614f35aa27abbe3f72c7",
      "SHA256=09043c51719d4bf6405c9a7a292bb9bb3bcc782f639b708ddcc4eedb5e5c9ce9",
      "IMPHASH=1f2627fc453dc35031a9502372bd3549"
    ]
  },
  "condition": "selection_hashes"
}

False Positives

  • ⚠ Unknown

Field Validations

Loading…

Comments (0)

Loading comments...