Skip to content

Commit

Permalink
updating yara
Browse files Browse the repository at this point in the history
  • Loading branch information
@josehelps
josehelps committed Jul 31, 2023
1 parent 9163029 commit b3d873f
Show file tree
Hide file tree
Showing 149 changed files with 11,238 additions and 1,868 deletions.
394 changes: 360 additions & 34 deletions detections/yara/yara-rules_mal_drivers.yar
View file

Large diffs are not rendered by default.

394 changes: 360 additions & 34 deletions detections/yara/yara-rules_mal_drivers_strict.yar
View file

Large diffs are not rendered by default.

3,596 changes: 3,011 additions & 585 deletions detections/yara/yara-rules_vuln_drivers.yar
View file

Large diffs are not rendered by default.

3,602 changes: 3,014 additions & 588 deletions detections/yara/yara-rules_vuln_drivers_strict.yar
View file

Large diffs are not rendered by default.

3,668 changes: 3,047 additions & 621 deletions detections/yara/yara-rules_vuln_drivers_strict_renamed.yar
View file

Large diffs are not rendered by default.

10 changes: 10 additions & 0 deletions yaml/0258df5c-c3c1-4ed5-ba8f-846d91526ffe.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,16 @@ Detection:
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml
- type: sysmon_hash_block
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml
- type: yara_signature
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar
- type: sigma_hash
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml
- type: sigma_names
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml
- type: sysmon_hash_detect
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml
- type: sysmon_hash_block
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml
Id: 0258df5c-c3c1-4ed5-ba8f-846d91526ffe
KnownVulnerableSamples:
- Authentihash:
Expand Down
10 changes: 10 additions & 0 deletions yaml/02e4a30f-8aa8-4ff0-8e02-1bff1d0f088f.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,16 @@ Created: '2023-07-22'
Detection:
- type: ''
value: ''
- type: yara_signature
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar
- type: sigma_hash
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml
- type: sigma_names
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml
- type: sysmon_hash_detect
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml
- type: sysmon_hash_block
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml
Id: 02e4a30f-8aa8-4ff0-8e02-1bff1d0f088f
KnownVulnerableSamples:
- Authentihash:
Expand Down
10 changes: 10 additions & 0 deletions yaml/04d377f9-36e0-42a4-8d47-62232163dc68.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,16 @@ Detection:
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml
- type: sysmon_hash_block
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml
- type: yara_signature
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar
- type: sigma_hash
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml
- type: sigma_names
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml
- type: sysmon_hash_detect
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml
- type: sysmon_hash_block
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml
Id: 04d377f9-36e0-42a4-8d47-62232163dc68
KnownVulnerableSamples:
- Authentihash:
Expand Down
10 changes: 10 additions & 0 deletions yaml/080a834f-3e19-4cae-b940-a4ecf901db28.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,16 @@ Created: '2023-07-22'
Detection:
- type: ''
value: ''
- type: yara_signature
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar
- type: sigma_hash
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml
- type: sigma_names
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml
- type: sysmon_hash_detect
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml
- type: sysmon_hash_block
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml
Id: 080a834f-3e19-4cae-b940-a4ecf901db28
KnownVulnerableSamples:
- Authentihash:
Expand Down
10 changes: 10 additions & 0 deletions yaml/080ff223-f8e0-49c0-a7b5-e97349cf81a0.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,16 @@ Detection:
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml
- type: sysmon_hash_block
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml
- type: yara_signature
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar
- type: sigma_hash
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml
- type: sigma_names
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml
- type: sysmon_hash_detect
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml
- type: sysmon_hash_block
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml
Id: 080ff223-f8e0-49c0-a7b5-e97349cf81a0
KnownVulnerableSamples:
- Authentihash:
Expand Down
10 changes: 10 additions & 0 deletions yaml/0baa833c-e4e1-449e-86ee-cafeb11f5fd5.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,16 @@ Created: '2023-07-22'
Detection:
- type: ''
value: ''
- type: yara_signature
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar
- type: sigma_hash
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml
- type: sigma_names
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml
- type: sysmon_hash_detect
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml
- type: sysmon_hash_block
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml
Id: 0baa833c-e4e1-449e-86ee-cafeb11f5fd5
KnownVulnerableSamples:
- Authentihash:
Expand Down
10 changes: 10 additions & 0 deletions yaml/0e3b0052-18c7-4c8b-a064-a1332df07af2.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,16 @@ Created: '2023-07-22'
Detection:
- type: ''
value: ''
- type: yara_signature
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar
- type: sigma_hash
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml
- type: sigma_names
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml
- type: sysmon_hash_detect
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml
- type: sysmon_hash_block
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml
Id: 0e3b0052-18c7-4c8b-a064-a1332df07af2
KnownVulnerableSamples:
- Authentihash:
Expand Down
10 changes: 10 additions & 0 deletions yaml/0f59ce3b-20ac-41ba-8010-2abc74827eb8.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,16 @@ Detection:
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml
- type: sysmon_hash_block
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml
- type: yara_signature
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar
- type: sigma_hash
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml
- type: sigma_names
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml
- type: sysmon_hash_detect
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml
- type: sysmon_hash_block
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml
Id: 0f59ce3b-20ac-41ba-8010-2abc74827eb8
KnownVulnerableSamples:
- Authentihash:
Expand Down
10 changes: 10 additions & 0 deletions yaml/0f8e317e-ad2b-4b02-9f96-603bb8d28604.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,16 @@ Created: '2023-07-22'
Detection:
- type: ''
value: ''
- type: yara_signature
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar
- type: sigma_hash
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml
- type: sigma_names
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml
- type: sysmon_hash_detect
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml
- type: sysmon_hash_block
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml
Id: 0f8e317e-ad2b-4b02-9f96-603bb8d28604
KnownVulnerableSamples:
- Authentihash:
Expand Down
10 changes: 10 additions & 0 deletions yaml/127cde1d-905e-4c67-a2c3-04ea4deaea7d.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,16 @@ Detection:
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml
- type: sysmon_hash_block
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml
- type: yara_signature
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_mal_drivers_strict.yar
- type: sigma_hash
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml
- type: sigma_names
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml
- type: sysmon_hash_detect
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml
- type: sysmon_hash_block
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml
Id: 127cde1d-905e-4c67-a2c3-04ea4deaea7d
KnownVulnerableSamples:
- Authentihash:
Expand Down
10 changes: 10 additions & 0 deletions yaml/137daca4-0d7b-48aa-8574-f7eb6ad02526.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,16 @@ Detection:
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml
- type: sysmon_hash_block
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml
- type: yara_signature
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar
- type: sigma_hash
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml
- type: sigma_names
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml
- type: sysmon_hash_detect
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml
- type: sysmon_hash_block
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml
Id: 137daca4-0d7b-48aa-8574-f7eb6ad02526
KnownVulnerableSamples:
- Authentihash:
Expand Down
10 changes: 10 additions & 0 deletions yaml/17cf4fac-88f1-467d-9f62-481d33accc5b.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,16 @@ Detection:
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml
- type: sysmon_hash_block
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml
- type: yara_signature
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar
- type: sigma_hash
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml
- type: sigma_names
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml
- type: sysmon_hash_detect
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml
- type: sysmon_hash_block
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml
Id: 17cf4fac-88f1-467d-9f62-481d33accc5b
KnownVulnerableSamples:
- Authentihash:
Expand Down
12 changes: 11 additions & 1 deletion yaml/19003e00-d42d-4cbe-91f3-756451bdd7da.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,17 @@ Commands:
Privileges: kernel
Usecase: Elevate privileges
Created: '2023-01-09'
Detection: []
Detection:
- type: yara_signature
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar
- type: sigma_hash
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml
- type: sigma_names
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml
- type: sysmon_hash_detect
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml
- type: sysmon_hash_block
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml
Id: 19003e00-d42d-4cbe-91f3-756451bdd7da
KnownVulnerableSamples:
- Company: ''
Expand Down
10 changes: 10 additions & 0 deletions yaml/19d16518-4aee-4983-ba89-dbbe0fa8a3e7.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,16 @@ Detection:
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml
- type: sysmon_hash_block
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml
- type: yara_signature
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar
- type: sigma_hash
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml
- type: sigma_names
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml
- type: sysmon_hash_detect
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml
- type: sysmon_hash_block
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml
Id: 19d16518-4aee-4983-ba89-dbbe0fa8a3e7
KnownVulnerableSamples:
- Authentihash:
Expand Down
10 changes: 10 additions & 0 deletions yaml/1aeb1205-8b02-42b6-a563-b953ea337c19.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,16 @@ Created: '2023-07-22'
Detection:
- type: ''
value: ''
- type: yara_signature
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar
- type: sigma_hash
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml
- type: sigma_names
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml
- type: sysmon_hash_detect
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml
- type: sysmon_hash_block
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml
Id: 1aeb1205-8b02-42b6-a563-b953ea337c19
KnownVulnerableSamples:
- Authentihash:
Expand Down
10 changes: 10 additions & 0 deletions yaml/1c6e1d3b-f825-4065-9e0c-83386883e40f.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,16 @@ Detection:
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml
- type: sysmon_hash_block
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml
- type: yara_signature
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar
- type: sigma_hash
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml
- type: sigma_names
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml
- type: sysmon_hash_detect
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml
- type: sysmon_hash_block
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml
Id: 1c6e1d3b-f825-4065-9e0c-83386883e40f
KnownVulnerableSamples:
- Authentihash:
Expand Down
10 changes: 10 additions & 0 deletions yaml/1c7631f0-f92f-4be5-8ba7-3eefb0601d45.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,16 @@ Detection:
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml
- type: sysmon_hash_block
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml
- type: yara_signature
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar
- type: sigma_hash
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml
- type: sigma_names
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml
- type: sysmon_hash_detect
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml
- type: sysmon_hash_block
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml
Id: 1c7631f0-f92f-4be5-8ba7-3eefb0601d45
KnownVulnerableSamples:
- Authentihash:
Expand Down
10 changes: 10 additions & 0 deletions yaml/1d2cdef1-de44-4849-80e5-e2fa288df681.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,16 @@ Detection:
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml
- type: sysmon_hash_block
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml
- type: yara_signature
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar
- type: sigma_hash
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml
- type: sigma_names
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml
- type: sysmon_hash_detect
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml
- type: sysmon_hash_block
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml
Id: 1d2cdef1-de44-4849-80e5-e2fa288df681
KnownVulnerableSamples:
- Authentihash:
Expand Down
10 changes: 10 additions & 0 deletions yaml/20076ebf-4427-4056-b035-5238f95debe9.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,16 @@ Detection:
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml
- type: sysmon_hash_block
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml
- type: yara_signature
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar
- type: sigma_hash
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml
- type: sigma_names
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml
- type: sysmon_hash_detect
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml
- type: sysmon_hash_block
value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml
Id: 20076ebf-4427-4056-b035-5238f95debe9
KnownVulnerableSamples:
- Authentihash:
Expand Down
Loading

0 comments on commit b3d873f

Please sign in to comment.