LOLDrivers high experimental sigma

Driver Load - POORTRY2.sys

Detects loading of driver POORTRY2.sys via hash. Driver categorized as POORTRY by Mandiant.

View Source

Detection Logic

{
  "selection_hashes": {
    "Hashes
| contains": [
      "MD5=b164daf106566f444dfb280d743bc2f7",
      "SHA1=7e836dadc2e149a0b758c7e22c989cbfcce18684",
      "SHA256=9bb09752cf3a464455422909edef518ac18fe63cf5e1e8d9d6c2e68db62e0c87",
      "IMPHASH=0ad7da35304c75ccf859bc29fe9ed09e"
    ]
  },
  "condition": "selection_hashes"
}

False Positives

  • ⚠ Unknown

Field Validations

Loading…

Comments (0)

Loading comments...