LOLDrivers high experimental sigma

Driver Load - kavservice.bin

Detects loading of driver kavservice.bin via hash.

View Source

Detection Logic

{
  "selection_hashes": {
    "Hashes
| contains": [
      "MD5=c419d7a8bc1cd5fe0af3ce4637c4d8a3",
      "SHA1=be80f4d2a669f60354703a21daffb7b2128de190",
      "SHA256=e055fdfb914e3da936eb7745acb665f50346df9abac597cf43d487262a6a12d5",
      "IMPHASH=2b12d7329b1917ae49f22618cc3316ec"
    ]
  },
  "condition": "selection_hashes"
}

False Positives

  • ⚠ Unknown

Field Validations

Loading…

Comments (0)

Loading comments...