Query: rule covering Detects loading of known vulnerable drivers via their hash.
Matching passage: Sigma rule: Detects loading of known vulnerable drivers via their hash.. Logsource: windows / driver_load. Rule: title: Vulnerable Driver Load id: 7aaaf4b8-e47c-4295-92ee-6ed40a6f60c8 status: test description: Detects loading of known vulnerable drivers via their hash. references: - https://loldrivers.io/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-18 modified: 2023-12-02 tags: - attack.persistence - attack.privilege-escalation - attack.t1543.003 - attack.t1068 logsource: product: windows category: driver_load detection: selection: Hashes|contains: - MD5=c996d7971c49252c582171d9380360f2 - MD5=da7e98b23b49b7293ee06713032c74f6 - MD5=9496585198d726000ea505abc39dbfe9 - MD5=649ff59b8e571c1fc6535b31662407aa - MD5=4429f85e2415742c7cf8c9f54905c4b9 - MD5=a610cd4c762b5af8575285dafb9baa8f - MD5=d5e76d125d624f8025d534f49e3c4162 - MD5=9c8fffef24fc480917236f9a20b80a47 - MD5=65b979bcab915c3922578fe77953d789 - MD5=598f8fb2317350e5f90b7bd16baf5738 - MD5=6691e873354f1914692df104718eebad - MD5=4814205270caa80d35569eee8081838e - MD5=7f9128654c3def08c28e0e13efff0fee - MD5=ce952204558ea66ec1a9632dcbdde8bd - MD5=0c0195c48b6b8582fa6f6373032118da - MD5=370a4ca29a7cf1d6bc0744afc12b236c - MD5=67e03f83c503c3f11843942df32efe5a - MD5=8a70921638ff82bb924456deadcd20e6 - MD5=8a212a246b3c41f3ddce5888aaaaacd6 - MD5=a346417e9ae2c17a8fbf73302eeb611d - MD5=d4f7c14e92b36c341c41ae93159407dd - MD5=748cf64b95ca83abc35762ad2c25458f - MD5=79ab228766c76cfdf42a64722821711e - MD5=ce67e51b8c0370d1bfe421b79fa8b656 - MD5=25190f667f31318dd9a2e36383d5709f - MD5=1f263a57c5ef46c8577744ecb32c9548 - MD5=c6cfa2d6e4c443e673c2c12417ea3001 - MD5=cceb3a7e3bd0203c807168b393a65a74 - MD5=56b54823a79a53747cbe11f8c4db7b1e - MD5=988dabdcf990b134b0ac1e00512c30c4 - MD5=09e77d71d626574e6142894caca6e6dd - MD5=c832a4313ff082258240b61b88efa025 - MD5=44499d3cab387aa78a4a6eca2ac181fb - MD5=6ff59faea912903af0ba8e80e58612bc - MD5=7461f0f9b931044a9d5f1d44eb4e8e09 - MD5=08bac71557df8a9b1381c8c165f64520 - MD5=fea9319d67177ed6f36438d2bd9392fb - MD5=6dd82d91f981893be57ff90101a7f7f1 - MD5=d4119a5cb07ce945c6549eae74e39731 - MD5=cf1113723e3c1c71af80d228f040c198 - MD5=0e625b7a7c3f75524e307b160f8db337 - MD5=6e1faeee0ebfcb384208772410fe1e86 - MD5=58a92520dda53166e322118ee0503364 - MD5=916ba55fc004b85939ee0cc86a5191c5 - MD5=f16b44cca74d3c3645e4c0a6bb5c0cb9 - MD5=db2fc89098ac722dabe3c37ed23de340 - MD5=6f5cf7feb9bb8108b68f169b8e625ffe - MD5=d2588631d8aae2a3e54410eaf54f0679 - MD5=72acbdd8fac58b71b301980eab3ebfc8 - MD5=9cc757a18b86408efc1ce3ed20cbcdac - MD5=230fd3749904ca045ea5ec0aa14006e9 - MD5=79329e2917623181888605bc5b302711 - MD5=3e4a
Near-miss passage: Sigma rule: Detects well-known credential dumping tools execution via service execution events. Logsource: windows / security. Rule: title: Credential Dumping Tools Service Execution - Security id: f0d1feba-4344-4ca9-8121-a6c97bd6df52 related: - id: 4976aa50-8f41-45c6-8b15-ab3fc10e79ed type: derived status: test description: Detects well-known credential dumping tools execution via service execution events references: - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment author: Florian Roth (Nextron Systems), Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community date: 2017-03-05 modified: 2022-11-29 tags: - attack.credential-access - attack.execution - attack.t1003.001 - attack.t1003.002 - attack.t1003.004 - attack.t1003.005 - attack.t1003.006 - attack.t1569.002 - attack.s0005 logsource: product: windows service: security definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697 detection: selection: EventID: 4697 ServiceFileName|contains: - cachedump - dumpsvc - fgexec - gsecdump - mimidrv - pwdump - servpw condition: selection falsepositives: - Legitimate Administrator using credential dumping tool for password recovery level: high