Title:Driver Load From A Temporary Directory Status:test Description:Detects a driver load from a temporary directory References: -Internal Research Author: Florian Roth (Nextron Systems) Date: 2017-02-12 modified:2021-11-27 Tags:
-'attack.persistence'
-'attack.privilege-escalation'
-'attack.t1543.003'
Logsource:
category: driver_load
product: windows
Detection: selection: ImageLoaded|contains:
'\Temp\' condition:selection Falsepositives:
-There is a relevant set of false positives depending on applications in the environment Level:high
