• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    Detect LOLDrivers

    avatar
    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    Rory Wagner@Sleuthifer
    •updated Jul 8, 2025•24•7•180

    Detecting LOLDrivers using www.loldrivers.io and MDE telemetry. This rule was created by Mehmet Ergene from BluRaven Academy and added to Detections.ai as it was missing from the repository.

    Microsoft Sentinel (KQL)

    Tags

    T1068 - Exploitation for Privilege EscalationT1218 - System Binary Proxy ExecutionT1553 - Subvert Trust ControlsTA0004 - Privilege EscalationTA0005 - Defense EvasionFile CreationDriver LoadWindowsAzure SentinelWindows Defender Atpkql

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?