SigmaHQ/rules/windows/sysmon/sysmon_susp_driver_load.yml
Yugoslavskiy Daniil 05cc7e455d atc review
2019-03-06 05:25:12 +01:00

18 lines
450 B
YAML

title: Suspicious Driver Load from Temp
description: Detects a driver load from a temporary directory
author: Florian Roth
tags:
- attack.persistence
- attack.t1050
logsource:
product: windows
service: sysmon
detection:
selection:
EventID: 6
ImageLoaded: '*\Temp\\*'
condition: selection
falsepositives:
- there is a relevant set of false positives depending on applications in the environment
level: medium