Moriya Rootkit Driver File Creation
Detects the creation of a file named "MoriyaStreamWatchmen.sys" in the 'C:\Windows\System32\drivers\' directory. This specific filename is associated with the Moriya rootkit, as detailed in the Securelist's "Operation TunnelSnake" report. The presence of this file indicates a potential rootkit installation attempt, which could lead to persistence and privilege escalation on a Windows system.
Sigma
