security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[Rule Tuning] Untrusted Driver Loaded (#5061)

Browse Source 
* [Rule Tuning] Untrusted Driver Loaded

* Update defense_evasion_untrusted_driver_loaded.toml
This commit is contained in:
Jonhnathan
2025-09-05 06:12:30 -07:00
committed by GitHub
parent 9ee15a13b0
commit 4aa6c4e715
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/defense_evasion_untrusted_driver_loaded.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2023/01/27"
integration = ["endpoint"]
maturity = "production"
updated_date = "2025/02/03"
updated_date = "2025/09/04"
[transform]
[[transform.osquery]]
@@ -112,7 +112,7 @@ type = "eql"
query = '''
driver where host.os.type == "windows" and process.pid == 4 and
dll.code_signature.trusted != true and
(dll.code_signature.trusted == false or dll.code_signature.exists == false) and
not dll.code_signature.status : ("errorExpired", "errorRevoked", "errorCode_endpoint:*")
'''