huntrule

Windows Driver Load with Image Path Containing \Temp\

Detects Windows driver loads whose ImageLoaded path contains the temporary directory (\Temp\).

FreeUnreviewedSigmahighv1
title: Windows Driver Load with Image Path Containing \Temp\
id: 8a29a853-7104-4c26-a000-0e7451973447
status: test
description: This rule flags Windows driver loads where the loaded image path includes the \Temp\ directory. Loading a driver from a temporary location can indicate staging or persistence techniques that abuse transient filesystem locations to execute privileged code. It relies on driver load events that expose the ImageLoaded field, matching any path containing the \Temp\ substring.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/driver_load/driver_load_win_susp_temp_use.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-02-12
modified: 2021-11-27
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1543.003
logsource:
  category: driver_load
  product: windows
detection:
  selection:
    ImageLoaded|contains: \Temp\
  condition: selection
falsepositives:
  - There is a relevant set of false positives depending on applications in the environment
level: high
license: DRL-1.1
related:
  - id: 2c4523d5-d481-4ed0-8ec3-7fbf0cb41a75
    type: derived

What it detects

This rule flags Windows driver loads where the loaded image path includes the \Temp\ directory. Loading a driver from a temporary location can indicate staging or persistence techniques that abuse transient filesystem locations to execute privileged code. It relies on driver load events that expose the ImageLoaded field, matching any path containing the \Temp\ substring.

Known false positives

  • There is a relevant set of false positives depending on applications in the environment

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.