Windows HackSys Extreme Vulnerable Driver (HEVD) .sys Load Detection

Flags Windows systems when HEVD driver \HEVD.sys is loaded with known IMPHASH values.

FreeUnreviewedSigmahighv1

windows-hacksys-extreme-vulnerable-driver-hevd-sys-load-detection-295c9289

title: Windows HackSys Extreme Vulnerable Driver (HEVD) .sys Load Detection
id: eda8ad7d-49dc-4bbd-b52c-46ca370e353e
status: test
description: This rule identifies loading of the HackSys Extreme Vulnerable Driver by matching the loaded driver image name ending with \HEVD.sys and specific imphash values. Kernel-mode drivers are powerful and can be abused for privilege escalation or other persistence techniques, so unexpected HEVD loading is a high-signal event. Telemetry required includes Windows driver load events containing the loaded image path/name and the file’s hash/IMPHASH.
references:
  - https://github.com/hacksysteam/HackSysExtremeVulnerableDriver
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/driver_load/driver_load_win_vuln_hevd_driver.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-18
modified: 2024-11-23
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1543.003
logsource:
  product: windows
  category: driver_load
detection:
  selection:
    - ImageLoaded|endswith: \HEVD.sys
    - Hashes|contains:
        - IMPHASH=f26d0b110873a1c7d8c4f08fbeab89c5
        - IMPHASH=c46ea2e651fd5f7f716c8867c6d13594
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 295c9289-acee-4503-a571-8eacaef36b28
    type: derived

What it detects

This rule identifies loading of the HackSys Extreme Vulnerable Driver by matching the loaded driver image name ending with \HEVD.sys and specific imphash values. Kernel-mode drivers are powerful and can be abused for privilege escalation or other persistence techniques, so unexpected HEVD loading is a high-signal event. Telemetry required includes Windows driver load events containing the loaded image path/name and the file’s hash/IMPHASH.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.