Query: alert when Detects loading of known vulnerable drivers via their hash.
Matching passage: Sigma rule: Detects loading of known vulnerable drivers via their hash.. Logsource: windows / driver_load. Rule: title: Vulnerable Driver Load id: 7aaaf4b8-e47c-4295-92ee-6ed40a6f60c8 status: test description: Detects loading of known vulnerable drivers via their hash. references: - https://loldrivers.io/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-18 modified: 2023-12-02 tags: - attack.persistence - attack.privilege-escalation - attack.t1543.003 - attack.t1068 logsource: product: windows category: driver_load detection: selection: Hashes|contains: - MD5=c996d7971c49252c582171d9380360f2 - MD5=da7e98b23b49b7293ee06713032c74f6 - MD5=9496585198d726000ea505abc39dbfe9 - MD5=649ff59b8e571c1fc6535b31662407aa - MD5=4429f85e2415742c7cf8c9f54905c4b9 - MD5=a610cd4c762b5af8575285dafb9baa8f - MD5=d5e76d125d624f8025d534f49e3c4162 - MD5=9c8fffef24fc480917236f9a20b80a47 - MD5=65b979bcab915c3922578fe77953d789 - MD5=598f8fb2317350e5f90b7bd16baf5738 - MD5=6691e873354f1914692df104718eebad - MD5=4814205270caa80d35569eee8081838e - MD5=7f9128654c3def08c28e0e13efff0fee - MD5=ce952204558ea66ec1a9632dcbdde8bd - MD5=0c0195c48b6b8582fa6f6373032118da - MD5=370a4ca29a7cf1d6bc0744afc12b236c - MD5=67e03f83c503c3f11843942df32efe5a - MD5=8a70921638ff82bb924456deadcd20e6 - MD5=8a212a246b3c41f3ddce5888aaaaacd6 - MD5=a346417e9ae2c17a8fbf73302eeb611d - MD5=d4f7c14e92b36c341c41ae93159407dd - MD5=748cf64b95ca83abc35762ad2c25458f - MD5=79ab228766c76cfdf42a64722821711e - MD5=ce67e51b8c0370d1bfe421b79fa8b656 - MD5=25190f667f31318dd9a2e36383d5709f - MD5=1f263a57c5ef46c8577744ecb32c9548 - MD5=c6cfa2d6e4c443e673c2c12417ea3001 - MD5=cceb3a7e3bd0203c807168b393a65a74 - MD5=56b54823a79a53747cbe11f8c4db7b1e - MD5=988dabdcf990b134b0ac1e00512c30c4 - MD5=09e77d71d626574e6142894caca6e6dd - MD5=c832a4313ff082258240b61b88efa025 - MD5=44499d3cab387aa78a4a6eca2ac181fb - MD5=6ff59faea912903af0ba8e80e58612bc - MD5=7461f0f9b931044a9d5f1d44eb4e8e09 - MD5=08bac71557df8a9b1381c8c165f64520 - MD5=fea9319d67177ed6f36438d2bd9392fb - MD5=6dd82d91f981893be57ff90101a7f7f1 - MD5=d4119a5cb07ce945c6549eae74e39731 - MD5=cf1113723e3c1c71af80d228f040c198 - MD5=0e625b7a7c3f75524e307b160f8db337 - MD5=6e1faeee0ebfcb384208772410fe1e86 - MD5=58a92520dda53166e322118ee0503364 - MD5=916ba55fc004b85939ee0cc86a5191c5 - MD5=f16b44cca74d3c3645e4c0a6bb5c0cb9 - MD5=db2fc89098ac722dabe3c37ed23de340 - MD5=6f5cf7feb9bb8108b68f169b8e625ffe - MD5=d2588631d8aae2a3e54410eaf54f0679 - MD5=72acbdd8fac58b71b301980eab3ebfc8 - MD5=9cc757a18b86408efc1ce3ed20cbcdac - MD5=230fd3749904ca045ea5ec0aa14006e9 - MD5=79329e2917623181888605bc5b302711 - MD5=3e4a
Near-miss passage: Sigma rule: Detects installation of suspicious packages using system installation utilities. Logsource: linux / process_creation. Rule: title: Suspicious Package Installed - Linux id: 700fb7e8-2981-401c-8430-be58e189e741 status: test description: Detects installation of suspicious packages using system installation utilities references: - https://gist.githubusercontent.com/MichaelKoczwara/12faba9c061c12b5814b711166de8c2f/raw/e2068486692897b620c25fde1ea258c8218fe3d3/history.txt author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-03 modified: 2026-01-01 tags: - attack.defense-impairment - attack.t1553.004 logsource: product: linux category: process_creation detection: selection_tool_apt: Image|endswith: - /apt - /apt-get CommandLine|contains: install selection_tool_yum: Image|endswith: /yum CommandLine|contains: - localinstall - install selection_tool_rpm: Image|endswith: /rpm CommandLine|contains: -i selection_tool_dpkg: Image|endswith: /dpkg CommandLine|contains: - --install - -i selection_keyword: CommandLine|contains: - nmap - ' nc' - netcat - wireshark - tshark - openconnect - proxychains - socat condition: 1 of selection_tool_* and selection_keyword falsepositives: - Legitimate administration activities level: medium