Detectionmediumtest
PUA - System Informer Driver Load
Detects driver load of the System Informer tool
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Florian Roth (Nextron Systems)Created Mon May 08Updated Sat Nov 2310cb6535-b31d-4512-9962-513dcbc42cc1windows
Log Source
WindowsDriver Load
ProductWindows← raw: windows
CategoryDriver Load← raw: driver_load
Detection Logic
Detection Logic1 selector
detection:
selection:
- ImageLoaded|endswith: '\SystemInformer.sys'
- Hashes|contains:
- 'SHA256=8B9AD98944AC9886EA4CB07700E71B78BE4A2740934BB7E46CA3B56A7C59AD24'
- 'SHA256=A41348BEC147CA4D9EA2869817527EB5CEA2E20202AF599D2B30625433BCF454'
- 'SHA256=38EE0A88AF8535A11EFE8D8DA9C6812AA07067B75A64D99705A742589BDD846D'
- 'SHA256=A773891ACF203A7EB0C0D30942FB1347648F1CD918AE2BFD9A4857B4DCF5081B'
- 'SHA256=4C3B81AC88A987BBDF7D41FA0AECC2CEDF5B9BD2F45E7A21F376D05345FC211D'
- 'SHA256=3241BC14BEC51CE6A691B9A3562E5C1D52E9D057D27A3D67FD0B245C350B6D34'
- 'SHA256=047C42E9BBA28366868847C7DAFC1E043FB038C796422D37220493517D68EE89'
- 'SHA256=18931DC81E95D0020466FA091E16869DBE824E543A4C2C8FE644FA71A0F44FEB'
- 'SHA256=B4C2EF76C204273132FDE38F0DED641C2C5EE767652E64E4C4071A4A973B6C1B'
- 'SHA256=640954AFC268565F7DAA6E6F81A8EE05311E33E34332B501A3C3FE5B22ADEA97'
- 'SHA256=251BE949F662C838718F8AA0A5F8211FB90346D02BD63FF91E6B224E0E01B656'
- 'SHA256=E2606F272F7BA054DF16BE464FDA57211EF0D14A0D959F9C8DCB0575DF1186E4'
- 'SHA256=3A9E1D17BEEB514F1B9B3BACAEE7420285DE5CBDCE89C5319A992C6CBD1DE138'
condition: selectionFalse Positives
System Informer is regularly used legitimately by system administrators or developers. Apply additional filters accordingly
MITRE ATT&CK
Rule Metadata
Rule ID
10cb6535-b31d-4512-9962-513dcbc42cc1
Status
test
Level
medium
Type
Detection
Created
Mon May 08
Modified
Sat Nov 23
Path
rules/windows/driver_load/driver_load_win_pua_system_informer.yml
Raw Tags
attack.persistenceattack.privilege-escalationattack.t1543