Osiris Ransomware POORTRY Driver Load Detection
Detects the installation or loading of the POORTRY (Abyssworker) driver, a vulnerable driver used by Osiris ransomware in Bring Your Own Vulnerable Driver (BYOVD) attacks to terminate security software. This rule identifies the driver by its file name, service name, known hashes, and a masquerading technique where it pretends to be a Malwarebytes component.
Microsoft Sentinel (KQL)
