LOLDrivers medium experimental sigma

Driver Load - CSAgent.sys

Detects loading of driver CSAgent.sys via name. AbyssWorker rootkit masquerading as a CrowdStrike Falcon sensor driver (CSAgent.sys). Signed with a revoked certificate from Shenzhen yundian Technology Co., Ltd. This is a fully malicious driver that blinds security products by stripping handles, terminating processes, and removing notification callbacks. Identified in ESET EDR killers research (March 2026) deployed alongside Medusa ransomware via the HEARTCRYPT packer.

View Source

Detection Logic

{
  "selection_name": {
    "ImageLoaded
| endswith": [
      "\\csagent.sys"
    ]
  },
  "condition": "selection_name"
}

False Positives

  • ⚠ Unknown

Field Validations

Loading…

Comments (0)

Loading comments...