RawWNPF rootkit device artefact

Daniel Jeremiah@daniyyell

•updated Jun 19, 2026•0•0•3

This rule detects the presence of the RawWNPF rootkit by searching for references to '\device\rawwnpf' or 'rawwnpf' in process command lines. It focuses on process events and provides causality fields for investigation.