Query: detect Detects loading of known vulnerable drivers via their hash. in logs
Matching passage: Sigma rule: Detects loading of known vulnerable drivers via their hash.. Logsource: windows / driver_load. Rule: title: Vulnerable Driver Load id: 7aaaf4b8-e47c-4295-92ee-6ed40a6f60c8 status: test description: Detects loading of known vulnerable drivers via their hash. references: - https://loldrivers.io/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-18 modified: 2023-12-02 tags: - attack.persistence - attack.privilege-escalation - attack.t1543.003 - attack.t1068 logsource: product: windows category: driver_load detection: selection: Hashes|contains: - MD5=c996d7971c49252c582171d9380360f2 - MD5=da7e98b23b49b7293ee06713032c74f6 - MD5=9496585198d726000ea505abc39dbfe9 - MD5=649ff59b8e571c1fc6535b31662407aa - MD5=4429f85e2415742c7cf8c9f54905c4b9 - MD5=a610cd4c762b5af8575285dafb9baa8f - MD5=d5e76d125d624f8025d534f49e3c4162 - MD5=9c8fffef24fc480917236f9a20b80a47 - MD5=65b979bcab915c3922578fe77953d789 - MD5=598f8fb2317350e5f90b7bd16baf5738 - MD5=6691e873354f1914692df104718eebad - MD5=4814205270caa80d35569eee8081838e - MD5=7f9128654c3def08c28e0e13efff0fee - MD5=ce952204558ea66ec1a9632dcbdde8bd - MD5=0c0195c48b6b8582fa6f6373032118da - MD5=370a4ca29a7cf1d6bc0744afc12b236c - MD5=67e03f83c503c3f11843942df32efe5a - MD5=8a70921638ff82bb924456deadcd20e6 - MD5=8a212a246b3c41f3ddce5888aaaaacd6 - MD5=a346417e9ae2c17a8fbf73302eeb611d - MD5=d4f7c14e92b36c341c41ae93159407dd - MD5=748cf64b95ca83abc35762ad2c25458f - MD5=79ab228766c76cfdf42a64722821711e - MD5=ce67e51b8c0370d1bfe421b79fa8b656 - MD5=25190f667f31318dd9a2e36383d5709f - MD5=1f263a57c5ef46c8577744ecb32c9548 - MD5=c6cfa2d6e4c443e673c2c12417ea3001 - MD5=cceb3a7e3bd0203c807168b393a65a74 - MD5=56b54823a79a53747cbe11f8c4db7b1e - MD5=988dabdcf990b134b0ac1e00512c30c4 - MD5=09e77d71d626574e6142894caca6e6dd - MD5=c832a4313ff082258240b61b88efa025 - MD5=44499d3cab387aa78a4a6eca2ac181fb - MD5=6ff59faea912903af0ba8e80e58612bc - MD5=7461f0f9b931044a9d5f1d44eb4e8e09 - MD5=08bac71557df8a9b1381c8c165f64520 - MD5=fea9319d67177ed6f36438d2bd9392fb - MD5=6dd82d91f981893be57ff90101a7f7f1 - MD5=d4119a5cb07ce945c6549eae74e39731 - MD5=cf1113723e3c1c71af80d228f040c198 - MD5=0e625b7a7c3f75524e307b160f8db337 - MD5=6e1faeee0ebfcb384208772410fe1e86 - MD5=58a92520dda53166e322118ee0503364 - MD5=916ba55fc004b85939ee0cc86a5191c5 - MD5=f16b44cca74d3c3645e4c0a6bb5c0cb9 - MD5=db2fc89098ac722dabe3c37ed23de340 - MD5=6f5cf7feb9bb8108b68f169b8e625ffe - MD5=d2588631d8aae2a3e54410eaf54f0679 - MD5=72acbdd8fac58b71b301980eab3ebfc8 - MD5=9cc757a18b86408efc1ce3ed20cbcdac - MD5=230fd3749904ca045ea5ec0aa14006e9 - MD5=79329e2917623181888605bc5b302711 - MD5=3e4a
Near-miss passage: Sigma rule: Detects a suspicious IIS module registration as described in Microsoft threat report on IIS backdoors. Logsource: windows / process_creation. Rule: title: Suspicious IIS Module Registration id: 043c4b8b-3a54-4780-9682-081cb6b8185c status: test description: Detects a suspicious IIS module registration as described in Microsoft threat report on IIS backdoors references: - https://www.microsoft.com/security/blog/2022/07/26/malicious-iis-extensions-quietly-open-persistent-backdoors-into-servers/ author: Florian Roth (Nextron Systems), Microsoft (idea) date: 2022-08-04 modified: 2023-01-23 tags: - attack.persistence - attack.t1505.004 logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: \w3wp.exe selection_cli_1: CommandLine|contains: appcmd.exe add module selection_cli_2: CommandLine|contains: ' system.enterpriseservices.internal.publish' Image|endswith: \powershell.exe selection_cli_3: CommandLine|contains|all: - gacutil - ' /I' condition: selection_parent and 1 of selection_cli_* falsepositives: - Administrative activity level: high