Forensics Driver Loaded

BIOC Informational

Forensics Driver Loaded

A forensics driver has been loaded.

Module:: Platform Analytics
Agent event type:: Module
Category:: Collection
Status:: Enabled

ATT&CK tactics: Collection (TA0009) Credential Access (TA0006)

ATT&CK techniques: Automated Collection (T1119) OS Credential Dumping (T1003)

XQL query:

{"stages":[{"FILTER":{"filter":{"AND":[{"AND":[{"AND":[{"AND":[{"LEFT":"$event_type","OPERATOR":"EQ","RIGHT":"$LOAD_IMAGE","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"},{"LEFT":"$event_sub_type","OPERATOR":"EQ","RIGHT":"$LOAD_IMAGE_PRELOAD","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$agent_os_type","OPERATOR":"EQ","RIGHT":"$AGENT_OS_WINDOWS","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$action_module_signature_vendor","OPERATOR":"EQ","RIGHT":"Binalyze LLC","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$action_module_signature_product","OPERATOR":"EQ","RIGHT":"Binalyze LLC","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]}}}],"original_query":null,"tables":["xdr_data"]}

Preventable: no