Rule Library

Sigma Rules

3 rules found for "xorxes"

3,707Total
3,116Detection
451Emerging
137Hunting
Detectionmediumtest

Potential Privileged System Service Operation - SeLoadDriverPrivilege

Detects the usage of the 'SeLoadDriverPrivilege' privilege. This privilege is required to load or unload a device driver. With this privilege, the user can dynamically load and unload device drivers or other code in to kernel mode. This user right does not apply to Plug and Play device drivers. If you exclude privileged users/admins and processes, which are allowed to do so, you are maybe left with bad programs trying to load malicious kernel drivers. This will detect Ghost-In-The-Logs (https://github.com/bats3c/Ghost-In-The-Logs) and the usage of Sysinternals and various other tools. So you have to work with a whitelist to find the bad stuff.

Windowssecurity
TA0005 · Defense EvasionT1562.001 · Disable or Modify Tools
xknow+1Mon Apr 08windows
Detectionmediumtest

Suspicious PROCEXP152.sys File Created In TMP

Detects the creation of the PROCEXP152.sys file in the application-data local temporary folder. This driver is used by Sysinternals Process Explorer but also by KDU (https://github.com/hfiref0x/KDU) or Ghost-In-The-Logs (https://github.com/bats3c/Ghost-In-The-Logs), which uses KDU.

WindowsFile Event
T1562.001 · Disable or Modify ToolsTA0005 · Defense Evasion
xknow+1Mon Apr 08windows
Detectionmediumtest

Suspicious Service Installed

Detects installation of NalDrv or PROCEXP152 services via registry-keys to non-system32 folders. Both services are used in the tool Ghost-In-The-Logs (https://github.com/bats3c/Ghost-In-The-Logs), which uses KDU (https://github.com/hfiref0x/KDU)

WindowsRegistry Set
T1562.001 · Disable or Modify ToolsTA0005 · Defense Evasion
xknow+1Mon Apr 08windows