Sessiongate Security Driver Discovery

Daniel Jeremiah@daniyyell

•updated Jun 20, 2026•0•0•1

This YARA rule detects the presence of specific strings associated with security drivers and system monitoring tools (ESET, Npcap, Sysmon) within a file or memory. The detection of these strings, particularly in a cluster, suggests an environment reconnaissance activity, potentially by malware like Sessiongate, which might be checking for the presence of security software or network capture tools.