Query: Sigma YAML for windows / driver_load
Matching passage: Sigma rule: Detects loading of known vulnerable drivers via their hash.. Logsource: windows / driver_load. Rule: title: Vulnerable Driver Load id: 7aaaf4b8-e47c-4295-92ee-6ed40a6f60c8 status: test description: Detects loading of known vulnerable drivers via their hash. references: - https://loldrivers.io/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-18 modified: 2023-12-02 tags: - attack.persistence - attack.privilege-escalation - attack.t1543.003 - attack.t1068 logsource: product: windows category: driver_load detection: selection: Hashes|contains: - MD5=c996d7971c49252c582171d9380360f2 - MD5=da7e98b23b49b7293ee06713032c74f6 - MD5=9496585198d726000ea505abc39dbfe9 - MD5=649ff59b8e571c1fc6535b31662407aa - MD5=4429f85e2415742c7cf8c9f54905c4b9 - MD5=a610cd4c762b5af8575285dafb9baa8f - MD5=d5e76d125d624f8025d534f49e3c4162 - MD5=9c8fffef24fc480917236f9a20b80a47 - MD5=65b979bcab915c3922578fe77953d789 - MD5=598f8fb2317350e5f90b7bd16baf5738 - MD5=6691e873354f1914692df104718eebad - MD5=4814205270caa80d35569eee8081838e - MD5=7f9128654c3def08c28e0e13efff0fee - MD5=ce952204558ea66ec1a9632dcbdde8bd - MD5=0c0195c48b6b8582fa6f6373032118da - MD5=370a4ca29a7cf1d6bc0744afc12b236c - MD5=67e03f83c503c3f11843942df32efe5a - MD5=8a70921638ff82bb924456deadcd20e6 - MD5=8a212a246b3c41f3ddce5888aaaaacd6 - MD5=a346417e9ae2c17a8fbf73302eeb611d - MD5=d4f7c14e92b36c341c41ae93159407dd - MD5=748cf64b95ca83abc35762ad2c25458f - MD5=79ab228766c76cfdf42a64722821711e - MD5=ce67e51b8c0370d1bfe421b79fa8b656 - MD5=25190f667f31318dd9a2e36383d5709f - MD5=1f263a57c5ef46c8577744ecb32c9548 - MD5=c6cfa2d6e4c443e673c2c12417ea3001 - MD5=cceb3a7e3bd0203c807168b393a65a74 - MD5=56b54823a79a53747cbe11f8c4db7b1e - MD5=988dabdcf990b134b0ac1e00512c30c4 - MD5=09e77d71d626574e6142894caca6e6dd - MD5=c832a4313ff082258240b61b88efa025 - MD5=44499d3cab387aa78a4a6eca2ac181fb - MD5=6ff59faea912903af0ba8e80e58612bc - MD5=7461f0f9b931044a9d5f1d44eb4e8e09 - MD5=08bac71557df8a9b1381c8c165f64520 - MD5=fea9319d67177ed6f36438d2bd9392fb - MD5=6dd82d91f981893be57ff90101a7f7f1 - MD5=d4119a5cb07ce945c6549eae74e39731 - MD5=cf1113723e3c1c71af80d228f040c198 - MD5=0e625b7a7c3f75524e307b160f8db337 - MD5=6e1faeee0ebfcb384208772410fe1e86 - MD5=58a92520dda53166e322118ee0503364 - MD5=916ba55fc004b85939ee0cc86a5191c5 - MD5=f16b44cca74d3c3645e4c0a6bb5c0cb9 - MD5=db2fc89098ac722dabe3c37ed23de340 - MD5=6f5cf7feb9bb8108b68f169b8e625ffe - MD5=d2588631d8aae2a3e54410eaf54f0679 - MD5=72acbdd8fac58b71b301980eab3ebfc8 - MD5=9cc757a18b86408efc1ce3ed20cbcdac - MD5=230fd3749904ca045ea5ec0aa14006e9 - MD5=79329e2917623181888605bc5b302711 - MD5=3e4a
Near-miss passage: Sigma rule: Detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been. Logsource: linux / process_creation. Rule: title: Remote Access Tool - Team Viewer Session Started On Linux Host id: 1f6b8cd4-3e60-47cc-b282-5aa1cbc9182d related: - id: ab70c354-d9ac-4e11-bbb6-ec8e3b153357 type: similar - id: f459ccb4-9805-41ea-b5b2-55e279e2424a type: similar status: test description: 'Detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder. ' references: - Internal Research author: Josh Nickels, Qi Nan date: 2024-03-11 tags: - attack.persistence - attack.initial-access - attack.t1133 logsource: category: process_creation product: linux detection: selection: ParentImage|endswith: /TeamViewer_Service Image|endswith: /TeamViewer_Desktop CommandLine|endswith: /TeamViewer_Desktop --IPCport 5939 --Module 1 condition: selection falsepositives: - Legitimate usage of TeamViewer level: low