Suspicious Service Installation by Ghost-In-The-Logs (NalDrv/PROCEXP152)
Detects the installation of 'NalDrv' or 'PROCEXP152' services by monitoring registry key modifications. These services are associated with the 'Ghost-In-The-Logs' tool, which leverages KDU for defense evasion. The rule specifically looks for the creation of these service ImagePath registry values in non-system32 folders, filtering out legitimate instances of tools like procexp and procmon.
Sigma
