LOLDrivers high experimental sigma

Driver Load - POORTRY.sys

Detects loading of driver POORTRY.sys via hash. Driver categorized as POORTRY by Mandiant.

View Source

Detection Logic

{
  "selection_hashes": {
    "Hashes
| contains": [
      "MD5=7f9309f5e4defec132b622fadbcad511",
      "SHA1=a3ed5cbfbc17b58243289f3cf575bf04be49591d",
      "SHA256=6b5cf41512255237064e9274ca8f8a3fef820c45aa6067c9c6a0e6f5751a0421",
      "IMPHASH=beceab354c66949088c9e5ed1f1ff2a4"
    ]
  },
  "condition": "selection_hashes"
}

False Positives

  • ⚠ Unknown

Field Validations

Loading…

Comments (0)

Loading comments...