LOLDrivers medium experimental sigma

Driver Load - burntcigar.sys

Detects loading of driver burntcigar.sys via name. BurntCigar (aka POORTRY) is a malicious kernel-mode rootkit driver used by multiple ransomware groups including Cuba, BlackCat, Medusa, LockBit, and RansomHub. Designed to disable and remove EDR solutions by terminating security processes and deleting critical security software files. VMProtect-packed driver signed with stolen Blueone Technology certificate. Detected by 32.9% of AV engines. Facilitates ransomware deployment by rendering systems defenseless.

View Source

Detection Logic

{
  "selection_name": {
    "ImageLoaded
| endswith": [
      "\\burntcigar.sys"
    ]
  },
  "condition": "selection_name"
}

False Positives

⚠ Unknown

Field Validations

Loading…

Comments (0)

Loading comments...