LOLDrivers high experimental sigma

Driver Load - NodeDriver.sys

Detects loading of driver NodeDriver.sys via hash. Driver categorized as POORTRY by Mandiant.

View Source

Detection Logic

{
  "selection_hashes": {
    "Hashes
| contains": [
      "MD5=ee6b1a79cb6641aa44c762ee90786fe0",
      "SHA1=3ef30c95e40a854cc4ded94fc503d0c3dc3e620e",
      "SHA256=05b146a48a69dd62a02759487e769bd30d39f16374bc76c86453b4ae59e7ffa4",
      "IMPHASH=e717abe060bc5c34925fe3120ac22f45"
    ]
  },
  "condition": "selection_hashes"
}

False Positives

  • ⚠ Unknown

Field Validations

Loading…

Comments (0)

Loading comments...