LOLDrivers high experimental sigma

Driver Load - NQrmq.sys

Detects loading of driver NQrmq.sys via hash. Found via RichPEHeaderHash pivoting.

View Source

Detection Logic

{
  "selection_hashes": {
    "Hashes
| contains": [
      "MD5=550b7991d93534bc510bc4f237155a7a",
      "SHA1=9382981b05b1fb950245313992444bfa0db5f881",
      "SHA256=ad938d15ecfd70083c474e1642a88b078c3cea02cdbddf66d4fb1c01b9b29d9a",
      "IMPHASH=dbf09dd3e675f15c7cc9b4d2b8e6cd90"
    ]
  },
  "condition": "selection_hashes"
}

False Positives

  • ⚠ Unknown

Field Validations

Loading…

Comments (0)

Loading comments...