GreenSection NVIDIA Shared Memory Corruption Crash
Detects potential exploitation attempts involving the NVIDIA global shared memory object (GreenSection) identified as \BaseNamedObjects\{52813408-3561-4705-820a-2b3b78be92ba}. The rule monitors for processes performing memory section operations (e.g., NtMapViewOfSection) in conjunction with driver-related command-line indicators or associated malicious process names, which may indicate an attempt to trigger a crash in nvoglv64.dll or exploit driver-level vulnerabilities.
Microsoft Sentinel (KQL)
