Synopsis
Activation Period |
14 Days |
Training Period |
30 Days |
Test Period |
N/A (single event) |
Deduplication Period |
1 Day |
Required Data |
|
Detection Modules |
|
Detector Tags |
|
ATT&CK Tactic |
|
ATT&CK Technique |
|
Severity |
Low |
Description
An uncommon driver loaded.
Attacker's Goals
Gaining kernel-level to gain full control over the machine or disable security products.
Investigative actions
Investigate which process created the driver or how it has been loaded.
Variations
Uncommon driver loaded by a Web server processGlobally rare and unsigned driver loaded
Uncommon driver with a globally rare vendor loaded as a service