Windows Driver Load: Process Hacker kernel driver processhacker.sys

Flags Windows driver loads of Process Hacker’s processhacker.sys using path and known imphash indicators.

FreeUnreviewedSigmahighv1

windows-driver-load-process-hacker-kernel-driver-processhacker-sys-67add051

title: "Windows Driver Load: Process Hacker kernel driver processhacker.sys"
id: 9ccc7984-49fb-4a66-9e23-8fb19e7f027a
related:
  - id: 10cb6535-b31d-4512-9962-513dcbc42cc1
    type: similar
  - id: 67add051-9ee7-4ad3-93ba-42935615ae8d
    type: derived
status: test
description: This rule identifies when the Windows kernel loads the Process Hacker driver file processhacker.sys. Attackers may use legitimate admin tooling components or driver-level functionality to assist persistence or privilege-related activity, making driver-load events a high-signal target. The detection relies on driver load telemetry including the loaded image path ending with the driver name and matching known imphash values for the driver.
references:
  - https://processhacker.sourceforge.io/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/driver_load/driver_load_win_pua_process_hacker.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-11-16
modified: 2024-11-23
tags:
  - attack.persistence
  - attack.privilege-escalation
  - cve.2021-21551
  - attack.t1543
logsource:
  category: driver_load
  product: windows
detection:
  selection:
    - ImageLoaded|endswith: \kprocesshacker.sys
    - Hashes|contains:
        - IMPHASH=821D74031D3F625BCBD0DF08B70F1E77
        - IMPHASH=F86759BB4DE4320918615DC06E998A39
        - IMPHASH=0A64EEB85419257D0CE32BD5D55C3A18
        - IMPHASH=6E7B34DFC017700B1517B230DF6FF0D0
  condition: selection
falsepositives:
  - Legitimate use of process hacker or system informer by developers or system administrators
level: high
license: DRL-1.1

What it detects

This rule identifies when the Windows kernel loads the Process Hacker driver file processhacker.sys. Attackers may use legitimate admin tooling components or driver-level functionality to assist persistence or privilege-related activity, making driver-load events a high-signal target. The detection relies on driver load telemetry including the loaded image path ending with the driver name and matching known imphash values for the driver.

Known false positives

Legitimate use of process hacker or system informer by developers or system administrators

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.