LOLDrivers high experimental sigma

Driver Load - Chaos-Rootkit.sys

Detects loading of driver Chaos-Rootkit.sys via hash. Chaos-Rootkit is a x64 ring0 rootkit with process hiding, privilege escalation, and capabilities for protecting and unprotecting processes, work on the latest Windows versions.

View Source

Detection Logic

{
  "selection_hashes": {
    "Hashes
| contains": [
      "MD5=9532893c1d358188d66b0d7b0784bb6b",
      "SHA1=d022f5e3c1bba43871af254a16ab0e378ea66184",
      "SHA256=0ae8d1dd56a8a000ced74a627052933d2e9bff31d251de185b3c0c5fc94a44db",
      "IMPHASH=3415f704b3149ea9a3d3a54036b208dd"
    ]
  },
  "condition": "selection_hashes"
}

False Positives

  • ⚠ Unknown

Field Validations

Loading…

Comments (0)

Loading comments...