PUA - Process Hacker Driver Load

Title: PUA - Process Hacker Driver Load
Status: test
Description:Detects driver load of the Process Hacker tool
References:
  -https://processhacker.sourceforge.io/
Author: Florian Roth (Nextron Systems)
Date: 2022-11-16
modified:2024-11-23
Tags:

• -'attack.persistence'
• -'attack.privilege-escalation'
• -'cve.2021-21551'
• -'attack.t1543'

Logsource:

• category: driver_load
• product: windows

Detection:
  selection:
ImageLoaded|endswith:'\kprocesshacker.sys'     - Hashes|contains:
      - 'IMPHASH=821D74031D3F625BCBD0DF08B70F1E77'
      - 'IMPHASH=F86759BB4DE4320918615DC06E998A39'
      - 'IMPHASH=0A64EEB85419257D0CE32BD5D55C3A18'
      - 'IMPHASH=6E7B34DFC017700B1517B230DF6FF0D0'
  condition:selection
Falsepositives:
  -Legitimate use of process hacker or system informer by developers or system administrators
Level: high