LOLDrivers high experimental sigma

Driver Load - prokiller64.sys

Detects loading of driver prokiller64.sys via hash. Signed POORTRY Samples

View Source

Detection Logic

{
  "selection_hashes": {
    "Hashes
| contains": [
      "MD5=10f3679384a03cb487bda9621ceb5f90",
      "SHA1=31cc8718894d6e6ce8c132f68b8caaba39b5ba7a",
      "SHA256=0440ef40c46fdd2b5d86e7feef8577a8591de862cfd7928cdbcc8f47b8fa3ffc",
      "IMPHASH=832219eb71b8bdb771f1d29d27b0acf4"
    ]
  },
  "condition": "selection_hashes"
}

False Positives

  • ⚠ Unknown

Field Validations

Loading…

Comments (0)

Loading comments...