Rule Library
Sigma Rules
2 rules found for "Anna Pham (Huntress)"
3,707Total
3,116Detection
451Emerging
137Hunting
Detectionhighexperimental
Devcon Execution Disabling VMware VMCI Device
Detects execution of devcon.exe with commands that disable the VMware Virtual Machine Communication Interface (VMCI) device. This can be legitimate during VMware Tools troubleshooting or driver conflicts, but may also indicate malware attempting to hijack communication with the hardware via the VMCI device. This has been used to facilitate VMware ESXi vulnerability exploits to escape VMs and execute code on the ESXi host.
WindowsProcess Creation
TA0005 · Defense EvasionTA0003 · PersistenceTA0004 · Privilege EscalationT1543.003 · Windows Service+1
Matt Anderson+2Fri Jan 02windows
Detectionhighexperimental
PUA - Kernel Driver Utility (KDU) Execution
Detects execution of the Kernel Driver Utility (KDU) tool. KDU can be used to bypass driver signature enforcement and load unsigned or malicious drivers into the Windows kernel. Potentially allowing for privilege escalation, persistence, or evasion of security controls.
WindowsProcess Creation
TA0003 · PersistenceTA0004 · Privilege EscalationT1543.003 · Windows Service
Matt Anderson+2Fri Jan 02windows