huntrule

Windows Malicious Driver Load by Known Hashes

Alerts on Windows driver loads matching known malicious driver hashes (MD5/SHA1/SHA256/IMPHASH).

FreeReviewedSigma · High · v2
Product
windows
Category
driver_load
Author
Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2022-08-18
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Persistence → Priv Esc

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Windows driver load events when the driver file hash matches a hardcoded list of known malicious hashes (MD5/SHA1/SHA256 and IMPHASH values). Loading a malicious kernel-mode driver can enable persistence and privileged access by running attacker-controlled code in the operating system. The detection relies on telemetry that records the driver load attempt along with the associated file hash values for comparison to the provided indicators.

Reporting behind it

Related detections9 linkedT1543.003 — drag to rearrange
Malicious Known Vulnerable Driver Load for BYOVD Attack
Suspicious Service Registration Loading Vulnerable Driver
Windows Malicious Driver Load Identified by Known Bad Driver File Names
Windows Driver Load of Known Vulnerable Drivers by File Name
Malicious Service DLL Hijack for Persistence via Lotus Blossom
Malicious TinyTurla ServiceDll Registration via svchost Group (via registry_set)
Malicious JuicyPotato Privilege Escalation Execution (UAT-7237)
Suspicious ToyMaker LAGTOY Service Creation Masquerading as WmiPrvSV via sc.exe
Malicious Service Creation With Autostart binPath via sc.exe (via process_creation)
Windows Malicious Driver Load by Known Hashes
Pivot detection · T1543.003 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.