LOLDrivers high experimental sigma

Driver Load - PcieCubed.sys

Detects loading of driver PcieCubed.sys via hash. Driver categorized as POORTRY by Mandiant.

View Source

Detection Logic

{
  "selection_hashes": {
    "Hashes
| contains": [
      "MD5=22949977ce5cd96ba674b403a9c81285",
      "SHA1=745335bcdf02fb42df7d890a24858e16094f48fd",
      "SHA256=fd223833abffa9cd6cc1848d77599673643585925a7ee51259d67c44d361cce8",
      "IMPHASH=3c5d2ffd06074f1b09c89465cc8bfbf7"
    ]
  },
  "condition": "selection_hashes"
}

False Positives

  • ⚠ Unknown

Field Validations

Loading…

Comments (0)

Loading comments...