Threat Hunting

Credential Compromise, Undetected Attackers, and More

  • 1 Topic
  • 0 Replies

1 Topic

J
josehelpsParticipant
posted in Threat Hunting

LOLDrivers Lacework LQL Detection

Hey everyone,I wanted to share something valuable with the community, especially since a few customers have inquired about this recently. We all know the significance of staying a step ahead in the cybersecurity landscape, and this is a step in that direction.LOLDrivers is a well-curated list of Windows drivers that adversaries commonly use to bypass security measures and execute attacks. It has been used quite often by many threat actors: https://cybernews.com/security/bring-your-own-vulnerable-driver-attack/.I've crafted a script that automatically fetches the latest malicious hashes from the LOLDrivers project and builds an LQL rule, which can be seamlessly deployed in your Lacework environment. This script serves as a tool to monitor and detect malicious drivers in real-time within your infrastructure.Here's how you can integrate this into your Lacework setup:1. Get the Script: Grab the script from this link.   2. Deploy the LQL Rule: Use the Lacework CLI with the following command

0
J
19 days ago

Badge winners

Show all badges
Terms of UseCookie settings