Merge pull request #122 from magicsword-io/yara_update

Updated enrich_with_yara.py and the driver yamls
magicsword-io · Jul 31, 2023 · 2ba5813 · 2ba5813
2 parents 8747981 + b3d873f
commit 2ba5813
Show file tree

Hide file tree

Showing 184 changed files with 24,517 additions and 1,898 deletions.
diff --git a/bin/enrich_with_yara.py b/bin/enrich_with_yara.py
@@ -1,6 +1,7 @@
 import argparse
 import os
 import yaml
+import re
 
 # Parse command-line arguments
 parser = argparse.ArgumentParser()
@@ -18,6 +19,15 @@
     {"type": "sysmon_hash_block", "value": base_url + "detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"}
 ]
 
+# Define YARA rules files
+yara_rules_files = [
+    "yara-rules_mal_drivers_strict.yar", 
+    "yara-rules_vuln_drivers_strict_renamed.yar", 
+    "yara-rules_vuln_drivers.yar",
+    "yara-rules_mal_drivers.yar",
+    "yara-rules_vuln_drivers_strict.yar"
+]
+
 # Loop through each YAML file in the directory
 for file_name in os.listdir('yaml'):
     if file_name.endswith('.yaml') or file_name.endswith('.yml'):
@@ -31,13 +41,23 @@
         updated = False
         for entry in yaml_data['KnownVulnerableSamples']:
             sha256 = entry.get('SHA256')
-            if sha256:
-                yara_file_path = os.path.join('detections/yara', f'{sha256}.yara')
-                if os.path.exists(yara_file_path):
-                    updated = True
-                    if args.verbose:
-                        print(f"Updating file: {file_path}")
-                    yaml_data['Detection'].append({"type": "yara_signature", "value": base_url + yara_file_path})
+        if sha256:
+            for yara_file_name in yara_rules_files:
+                yara_file_path = os.path.join('detections/yara', yara_file_name)
+
+                # Load YARA rules from the file
+                with open(yara_file_path, 'r') as f:
+                    yara_rules = f.read()
+
+                # Check if a rule exists for the specific sample
+                if re.search(f'{sha256}', yara_rules):
+                    yara_link = {"type": "yara_signature", "value": base_url + yara_file_path}
+                    if yara_link not in yaml_data['Detection']:
+                        updated = True
+                        if args.verbose:
+                            print(f"Updating file: {file_path}")
+                        yaml_data['Detection'].append(yara_link)
+                    break
 
         # Add specific sigma and sysmon rules to detections
         yaml_data['Detection'].extend(sigma_rules)
@@ -47,4 +67,3 @@
         if updated:
             with open(file_path, 'w') as f:
                 yaml.dump(yaml_data, f, sort_keys=False)
-
diff --git a/detections/yara/yara-rules_mal_drivers.yar b/detections/yara/yara-rules_mal_drivers.yar
diff --git a/detections/yara/yara-rules_mal_drivers_strict.yar b/detections/yara/yara-rules_mal_drivers_strict.yar
diff --git a/detections/yara/yara-rules_vuln_drivers.yar b/detections/yara/yara-rules_vuln_drivers.yar
diff --git a/detections/yara/yara-rules_vuln_drivers_strict.yar b/detections/yara/yara-rules_vuln_drivers_strict.yar
diff --git a/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar b/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar
diff --git a/yaml/0258df5c-c3c1-4ed5-ba8f-846d91526ffe.yaml b/yaml/0258df5c-c3c1-4ed5-ba8f-846d91526ffe.yaml
@@ -22,6 +22,16 @@ Detection:
   value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml
 - type: sysmon_hash_block
   value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml
+- type: yara_signature
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar
+- type: sigma_hash
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml
+- type: sigma_names
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml
+- type: sysmon_hash_detect
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml
+- type: sysmon_hash_block
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml
 Id: 0258df5c-c3c1-4ed5-ba8f-846d91526ffe
 KnownVulnerableSamples:
 - Authentihash:

diff --git a/yaml/02e4a30f-8aa8-4ff0-8e02-1bff1d0f088f.yaml b/yaml/02e4a30f-8aa8-4ff0-8e02-1bff1d0f088f.yaml
@@ -15,6 +15,16 @@ Created: '2023-07-22'
 Detection:
 - type: ''
   value: ''
+- type: yara_signature
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar
+- type: sigma_hash
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml
+- type: sigma_names
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml
+- type: sysmon_hash_detect
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml
+- type: sysmon_hash_block
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml
 Id: 02e4a30f-8aa8-4ff0-8e02-1bff1d0f088f
 KnownVulnerableSamples:
 - Authentihash:

diff --git a/yaml/043773c5-120a-4c6b-8485-8f1f5c47fd3e.yml b/yaml/043773c5-120a-4c6b-8485-8f1f5c47fd3e.yml
@@ -16,7 +16,17 @@ Resources:
 Acknowledgement:
   Person: []
   Handle: ''
-Detection: []
+Detection:
+- type: yara_signature
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar
+- type: sigma_hash
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml
+- type: sigma_names
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml
+- type: sysmon_hash_detect
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml
+- type: sysmon_hash_block
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml
 KnownVulnerableSamples:
 - Filename: aswArPot.sys
   MD5: c61876aaca6ce822be18adb9d9bd4260

diff --git a/yaml/04d377f9-36e0-42a4-8d47-62232163dc68.yaml b/yaml/04d377f9-36e0-42a4-8d47-62232163dc68.yaml
@@ -24,6 +24,16 @@ Detection:
   value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml
 - type: sysmon_hash_block
   value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml
+- type: yara_signature
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar
+- type: sigma_hash
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml
+- type: sigma_names
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml
+- type: sysmon_hash_detect
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml
+- type: sysmon_hash_block
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml
 Id: 04d377f9-36e0-42a4-8d47-62232163dc68
 KnownVulnerableSamples:
 - Authentihash:

diff --git a/yaml/0567c6c4-282f-406f-9369-7f876b899c25.yml b/yaml/0567c6c4-282f-406f-9369-7f876b899c25.yml
@@ -94,6 +94,16 @@ Detection:
   value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml
 - type: sysmon_hash_block
   value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml
+- type: yara_signature
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar
+- type: sigma_hash
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml
+- type: sigma_names
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml
+- type: sysmon_hash_detect
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml
+- type: sysmon_hash_block
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml
 KnownVulnerableSamples:
 - Filename: procexp.Sys
   MD5: e6cb1728c50bd020e531d19a14904e1c

diff --git a/yaml/080a834f-3e19-4cae-b940-a4ecf901db28.yaml b/yaml/080a834f-3e19-4cae-b940-a4ecf901db28.yaml
@@ -15,6 +15,16 @@ Created: '2023-07-22'
 Detection:
 - type: ''
   value: ''
+- type: yara_signature
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar
+- type: sigma_hash
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml
+- type: sigma_names
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml
+- type: sysmon_hash_detect
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml
+- type: sysmon_hash_block
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml
 Id: 080a834f-3e19-4cae-b940-a4ecf901db28
 KnownVulnerableSamples:
 - Authentihash:

diff --git a/yaml/080ff223-f8e0-49c0-a7b5-e97349cf81a0.yaml b/yaml/080ff223-f8e0-49c0-a7b5-e97349cf81a0.yaml
@@ -22,6 +22,16 @@ Detection:
   value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml
 - type: sysmon_hash_block
   value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml
+- type: yara_signature
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar
+- type: sigma_hash
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml
+- type: sigma_names
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml
+- type: sysmon_hash_detect
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml
+- type: sysmon_hash_block
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml
 Id: 080ff223-f8e0-49c0-a7b5-e97349cf81a0
 KnownVulnerableSamples:
 - Authentihash:

diff --git a/yaml/0baa833c-e4e1-449e-86ee-cafeb11f5fd5.yaml b/yaml/0baa833c-e4e1-449e-86ee-cafeb11f5fd5.yaml
@@ -15,6 +15,16 @@ Created: '2023-07-22'
 Detection:
 - type: ''
   value: ''
+- type: yara_signature
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar
+- type: sigma_hash
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml
+- type: sigma_names
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml
+- type: sysmon_hash_detect
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml
+- type: sysmon_hash_block
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml
 Id: 0baa833c-e4e1-449e-86ee-cafeb11f5fd5
 KnownVulnerableSamples:
 - Authentihash:

diff --git a/yaml/0e3b0052-18c7-4c8b-a064-a1332df07af2.yaml b/yaml/0e3b0052-18c7-4c8b-a064-a1332df07af2.yaml
@@ -15,6 +15,16 @@ Created: '2023-07-22'
 Detection:
 - type: ''
   value: ''
+- type: yara_signature
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar
+- type: sigma_hash
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml
+- type: sigma_names
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml
+- type: sysmon_hash_detect
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml
+- type: sysmon_hash_block
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml
 Id: 0e3b0052-18c7-4c8b-a064-a1332df07af2
 KnownVulnerableSamples:
 - Authentihash:

diff --git a/yaml/0e8da43d-92e0-43f9-bc34-50a7d15b34bd.yml b/yaml/0e8da43d-92e0-43f9-bc34-50a7d15b34bd.yml
@@ -16,7 +16,17 @@ Resources:
 Acknowledgement:
   Person: Michael Alfaro
   Handle: '@_mmpte_software'
-Detection: []
+Detection:
+- type: yara_signature
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar
+- type: sigma_hash
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml
+- type: sigma_names
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml
+- type: sysmon_hash_detect
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml
+- type: sysmon_hash_block
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml
 KnownVulnerableSamples:
 - Filename: etdsupp.sys
   MD5: a92bf3c219a5fa82087b6c31bdf36ff3

diff --git a/yaml/0f59ce3b-20ac-41ba-8010-2abc74827eb8.yaml b/yaml/0f59ce3b-20ac-41ba-8010-2abc74827eb8.yaml
@@ -22,6 +22,16 @@ Detection:
   value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml
 - type: sysmon_hash_block
   value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml
+- type: yara_signature
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar
+- type: sigma_hash
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml
+- type: sigma_names
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml
+- type: sysmon_hash_detect
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml
+- type: sysmon_hash_block
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml
 Id: 0f59ce3b-20ac-41ba-8010-2abc74827eb8
 KnownVulnerableSamples:
 - Authentihash:

diff --git a/yaml/0f8e317e-ad2b-4b02-9f96-603bb8d28604.yaml b/yaml/0f8e317e-ad2b-4b02-9f96-603bb8d28604.yaml
@@ -15,6 +15,16 @@ Created: '2023-07-22'
 Detection:
 - type: ''
   value: ''
+- type: yara_signature
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar
+- type: sigma_hash
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml
+- type: sigma_names
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml
+- type: sysmon_hash_detect
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml
+- type: sysmon_hash_block
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml
 Id: 0f8e317e-ad2b-4b02-9f96-603bb8d28604
 KnownVulnerableSamples:
 - Authentihash:

diff --git a/yaml/10b1fc3d-c444-4885-8ca9-4b5891885507.yml b/yaml/10b1fc3d-c444-4885-8ca9-4b5891885507.yml
@@ -30,6 +30,16 @@ Detection:
   value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml
 - type: sysmon_hash_block
   value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml
+- type: yara_signature
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar
+- type: sigma_hash
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml
+- type: sigma_names
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml
+- type: sysmon_hash_detect
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml
+- type: sysmon_hash_block
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml
 KnownVulnerableSamples:
 - Filename: atillk64.sys
   MD5: 27d21eeff199ed555a29ca0ea4453cfb

diff --git a/yaml/127cde1d-905e-4c67-a2c3-04ea4deaea7d.yaml b/yaml/127cde1d-905e-4c67-a2c3-04ea4deaea7d.yaml
@@ -22,6 +22,16 @@ Detection:
   value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml
 - type: sysmon_hash_block
   value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml
+- type: yara_signature
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_mal_drivers_strict.yar
+- type: sigma_hash
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml
+- type: sigma_names
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml
+- type: sysmon_hash_detect
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml
+- type: sysmon_hash_block
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml
 Id: 127cde1d-905e-4c67-a2c3-04ea4deaea7d
 KnownVulnerableSamples:
 - Authentihash:

diff --git a/yaml/13637210-2e1c-45a4-9f76-fe38c3c34264.yml b/yaml/13637210-2e1c-45a4-9f76-fe38c3c34264.yml
@@ -16,7 +16,17 @@ Resources:
 Acknowledgement:
   Person: []
   Handle: ''
-Detection: []
+Detection:
+- type: yara_signature
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar
+- type: sigma_hash
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml
+- type: sigma_names
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml
+- type: sysmon_hash_detect
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml
+- type: sysmon_hash_block
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml
 KnownVulnerableSamples:
 - Filename: HpPortIox64.sys
   MD5: 7b9e1e5e8ff4f18f84108bb9f7b5d108

diff --git a/yaml/137daca4-0d7b-48aa-8574-f7eb6ad02526.yaml b/yaml/137daca4-0d7b-48aa-8574-f7eb6ad02526.yaml
@@ -24,6 +24,16 @@ Detection:
   value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml
 - type: sysmon_hash_block
   value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml
+- type: yara_signature
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar
+- type: sigma_hash
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml
+- type: sigma_names
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml
+- type: sysmon_hash_detect
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml
+- type: sysmon_hash_block
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml
 Id: 137daca4-0d7b-48aa-8574-f7eb6ad02526
 KnownVulnerableSamples:
 - Authentihash:

diff --git a/yaml/13973a71-412f-4a18-a2a6-476d3853f8de.yml b/yaml/13973a71-412f-4a18-a2a6-476d3853f8de.yml
@@ -17,7 +17,17 @@ Resources:
 Acknowledgement:
   Person: []
   Handle: ''
-Detection: []
+Detection:
+- type: yara_signature
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar
+- type: sigma_hash
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml
+- type: sigma_names
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml
+- type: sysmon_hash_detect
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml
+- type: sysmon_hash_block
+  value: https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml
 KnownVulnerableSamples:
 - Filename: AMDRyzenMasterDriver.sys
   MD5: f16b44cca74d3c3645e4c0a6bb5c0cb9