Query: detection rule: Detects loading of known malicious drivers via their hash.
Matching passage: Sigma rule: Detects loading of known malicious drivers via their hash.. Logsource: windows / driver_load. Rule: title: Malicious Driver Load id: 05296024-fe8a-4baf-8f3d-9a5f5624ceb2 status: test description: Detects loading of known malicious drivers via their hash. references: - https://loldrivers.io/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-18 modified: 2023-12-02 tags: - attack.persistence - attack.privilege-escalation - attack.t1543.003 - attack.t1068 logsource: product: windows category: driver_load detection: selection: Hashes|contains: - MD5=5be61a24f50eb4c94d98b8a82ef58dcf - MD5=d70a80fc73dd43469934a7b1cc623c76 - MD5=3b71eab204a5f7ed77811e41fed73105 - MD5=528ce5ce19eb34f401ef024de7ddf222 - MD5=ae548418b491cd3f31618eb9e5730973 - MD5=72f53f55898548767e0276c472be41e8 - MD5=508faa4647f305a97ed7167abc4d1330 - MD5=ed2b653d55c03f0bffa250372d682b75 - MD5=0d2ba47286f1c68e87622b3a16bf9d92 - MD5=3164bd6c12dd0fe1bdf3b833d56323b9 - MD5=70fd7209ce5c013a1f9e699b5cc86cdc - MD5=c71be7b112059d2dc84c0f952e04e6cc - MD5=acac842a46f3501fe407b1db1b247a0b - MD5=01c2e4d8234258451083d6ce4e8910b7 - MD5=c8541a9cef64589593e999968a0385b9 - MD5=e172a38ade3aa0a2bc1bf9604a54a3b5 - MD5=6fcf56f6ca3210ec397e55f727353c4a - MD5=2b80be31fbb11d4c1ef6d6a80b2e0c16 - MD5=07056573d464b0f5284f7e3acedd4a3f - MD5=c7b7f1edb9bbef174e6506885561d85d - MD5=d5918d735a23f746f0e83f724c4f26e5 - MD5=84763d8ca9fe5c3bff9667b2adf667de - MD5=fb593b1f1f80d20fc7f4b818065c64b6 - MD5=909f3fc221acbe999483c87d9ead024a - MD5=e29f6311ae87542b3d693c1f38e4e3ad - MD5=aeb0801f22d71c7494e884d914446751 - MD5=3f11a94f1ac5efdd19767c6976da9ba4 - MD5=be6318413160e589080df02bb3ca6e6a - MD5=0b311af53d2f4f77d30f1aed709db257 - MD5=d075d56dfce6b9b13484152b1ef40f93 - MD5=27384ec4c634701012a2962c30badad2 - MD5=5eb2c576597dd21a6b44557c237cf896 - MD5=f56db4eba3829c0918413b5c0b42f00f - MD5=e27b2486aa5c256b662812b465b6036c - MD5=db86dfd7aefbb5be6728a63461b0f5f3 - MD5=04a88f5974caa621cee18f34300fc08a - MD5=5129d8fd53d6a4aba81657ab2aa5d243 - MD5=cd2c641788d5d125c316ed739c69bb59 - MD5=7073cd0085fcba1cd7d3568f9e6d652c - MD5=24f0f2b4b3cdae11de1b81c537df41c7 - MD5=88bea56ae9257b40063785cf47546024 - MD5=63060b756377fce2ce4ab9d079ca732f - MD5=50b39072d0ee9af5ef4824eca34be6e3 - MD5=57c18a8f5d1ba6d015e4d5bc698e3624 - MD5=7d26985a5048bad57d9c223362f3d55c - MD5=ba54a0dbe2685e66e21d41b4529b3528 - MD5=4ad8fd9e83d7200bd7f8d0d4a9abfb11 - MD5=b52f51bbe6b49d0b475d943c29c4d4cb - MD5=a837302307dace2a00d07202b661bce2 - MD5=78a122d926ccc371d60c861600c310f3 - MD5=bdb305aa0806f8b38b7ce43c927fe919 - MD5=27053e964667318e1b370150cbca9138 - MD5=6a4fbc
Near-miss passage: Sigma rule: Detects the execution of a renamed binary often used by attackers or malware leveraging new Sysmon OriginalFileName data. Logsource: windows / process_creation. Rule: title: Potential Defense Evasion Via Rename Of Highly Relevant Binaries id: 0ba1da6d-b6ce-4366-828c-18826c9de23e related: - id: 36480ae1-a1cb-4eaa-a0d6-29801d7e9142 type: similar - id: 2569ed8c-1147-498a-9b8c-2ad3656b10ed type: derived - id: a7a7e0e5-1d57-49df-9c58-9fe5bc0346a2 type: obsolete - id: d178a2d7-129a-4ba4-8ee6-d6e1fecd5d20 type: obsolete - id: d4d2574f-ac17-4d9e-b986-aeeae0dc8fe2 type: obsolete status: test description: Detects the execution of a renamed binary often used by attackers or malware leveraging new Sysmon OriginalFileName datapoint. references: - https://mgreen27.github.io/posts/2019/05/12/BinaryRename.html - https://mgreen27.github.io/posts/2019/05/29/BinaryRename2.html - https://www.trendmicro.com/vinfo/hk-en/security/news/cybercrime-and-digital-threats/megacortex-ransomware-spotted-attacking-enterprise-networks - https://twitter.com/christophetd/status/1164506034720952320 - https://threatresearch.ext.hp.com/svcready-a-new-loader-reveals-itself/ - https://www.huntress.com/blog/malicious-browser-extention-crashfix-kongtuke author: Matthew Green - @mgreen27, Florian Roth (Nextron Systems), frack113 date: 2019-06-15 modified: 2026-06-29 tags: - attack.stealth - attack.t1036.003 - car.2013-05-009 logsource: category: process_creation product: windows detection: selection: - Description: Execute processes remotely - Product: Sysinternals PsExec - Description|startswith: - Windows PowerShell - pwsh - OriginalFileName: - certutil.exe - cmstp.exe - cscript.exe - IE4UINIT.EXE - finger.exe - mshta.exe - msiexec.exe - msxsl.exe - powershell_ise.exe - powershell.exe - psexec.c - psexec.exe - psexesvc.exe - pwsh.dll - reg.exe - regsvr32.exe - rundll32.exe - WerMgr - wmic.exe - wscript.exe filter: Image|endswith: - \certutil.exe - \cmstp.exe - \cscript.exe - \ie4uinit.exe - \finger.exe - \mshta.exe - \msiexec.exe - \msxsl.exe - \powershell_ise.exe - \powershell.exe - \psexec.exe - \psexec64.exe - \psexec64a.exe - \PSEXESVC.exe - \pwsh.exe - \reg.exe - \regsvr32.exe - \rundll32.exe - \wermgr.exe - \wmic.exe - \wscript.exe condition: selection and not filter falsepositives: - Custom applications use renamed binaries adding slight change to binary name. Typically this is easy to spot and add to whitelist - PsExec installed via Windows Store doesn't contain original filename field (False negative) level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_renamed_binary_highly_relevant/info.yml