mirror of
https://github.com/S12cybersecurity/YaraRules
synced 2026-06-08 12:22:33 +00:00
S12cybersecurity
24 lines
818 B
Plaintext
24 lines
818 B
Plaintext
rule Fileless_Driver_Loading_Section_Object
|
|
{
|
|
meta:
|
|
author = "0x12 Dark Development"
|
|
description = "Detects driver loading via NtCreateSection and NtLoadDriver without leaving file traces on disk"
|
|
date = "2025-06-04"
|
|
technique = "Fileless Driver Load via Section Object"
|
|
reference = "https://maldevacademy.com"
|
|
|
|
strings:
|
|
$s1 = "NtCreateSection" wide ascii
|
|
$s2 = "NtLoadDriver" wide ascii
|
|
$s3 = "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\" wide ascii
|
|
$s4 = "\\??\\" wide ascii
|
|
$s5 = "SE_LOAD_DRIVER_NAME" wide ascii
|
|
$s6 = "SEC_IMAGE" ascii
|
|
$s7 = "ImagePath" wide ascii
|
|
$s8 = "SERVICE_KERNEL_DRIVER" ascii
|
|
|
|
condition:
|
|
uint16(0) == 0x5A4D and // PE file magic
|
|
4 of ($s*)
|
|
}
|