LOLDrivers high experimental sigma

Driver Load - BlackBoneDrv10.sys

Detects loading of driver BlackBoneDrv10.sys via hash.

View Source

Detection Logic

{
  "selection_hashes": {
    "Hashes
| contains": [
      "MD5=f7393fb917aed182e4cbef25ce8af950",
      "SHA1=3ee2fd08137e9262d2e911158090e4a7c7427ea0",
      "SHA256=f51bdb0ad924178131c21e39a8ccd191e46b5512b0f2e1cc8486f63e84e5d960",
      "IMPHASH=5988ec9f159fefbdf89d893aa634dd92"
    ]
  },
  "condition": "selection_hashes"
}

False Positives

  • ⚠ Unknown

Field Validations

Loading…

Comments (0)

Loading comments...