LOLDrivers high experimental sigma

Driver Load - HOSTNT.sys

Detects loading of driver HOSTNT.sys via hash. Hostnt 64-bit driver

View Source

Detection Logic

{
  "selection_hashes": {
    "Hashes
| contains": [
      "MD5=e8ebba56ea799e1e62748c59e1a4c586",
      "SHA1=ac13941f436139b909d105ad55637e1308f49d9a",
      "SHA256=07b6d69bafcfd767f1b63a490a8843c3bb1f8e1bbea56176109b5743c8f7d357",
      "IMPHASH=b4c562c2c654abd2cc71658646314976"
    ]
  },
  "condition": "selection_hashes"
}

False Positives

  • ⚠ Unknown

Field Validations

Loading…

Comments (0)

Loading comments...