Windows Malicious Driver Load Identified by Known Driver File Names

title: Windows Malicious Driver Load Identified by Known Driver File Names
id: 0aff679d-fc86-4367-8a29-67e764c01921
status: test
description: This rule flags Windows driver loads where the loaded driver image path ends with a set of known suspicious driver file names. Attackers may use malicious or vulnerable drivers to persist on the system or elevate privileges, making driver-load events a high-signal telemetry source. The detection relies on driver load logging that includes the loaded image path (ImageLoaded).
references:
  - https://loldrivers.io/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/driver_load/driver_load_win_mal_drivers_names.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-10-03
modified: 2023-12-02
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1543.003
  - attack.t1068
logsource:
  product: windows
  category: driver_load
detection:
  selection:
    ImageLoaded|endswith:
      - \wfshbr64.sys
      - \ktmutil7odm.sys
      - \ktes.sys
      - \a26363e7b02b13f2b8d697abb90cd5c3.sys
      - \kt2.sys
      - \4748696211bd56c2d93c21cab91e82a5.sys
      - \malicious.sys
      - \a236e7d654cd932b7d11cb604629a2d0.sys
      - \spwizimgvt.sys
      - \c94f405c5929cfcccc8ad00b42c95083.sys
      - \fur.sys
      - \wantd.sys
      - \windbg.sys
      - \4118b86e490aed091b1a219dba45f332.sys
      - \gmer64.sys
      - \1fc7aeeff3ab19004d2e53eae8160ab1.sys
      - \poortry2.sys
      - \wintapix.sys
      - \daxin_blank6.sys
      - \6771b13a53b9c7449d4891e427735ea2.sys
      - \blacklotus_driver.sys
      - \air_system10.sys
      - \dkrtk.sys
      - \7.sys
      - \sense5ext.sys
      - \ktgn.sys
      - \ndislan.sys
      - \nlslexicons0024uvn.sys
      - \be6318413160e589080df02bb3ca6e6a.sys
      - \4.sys
      - \wantd_2.sys
      - \e29f6311ae87542b3d693c1f38e4e3ad.sys
      - \daxin_blank3.sys
      - \gftkyj64.sys
      - \daxin_blank2.sys
      - \wantd_4.sys
      - \reddriver.sys
      - \834761775.sys
      - \mlgbbiicaihflrnh.sys
      - \mjj0ge.sys
      - \daxin_blank.sys
      - \daxin_blank5.sys
      - \poortry1.sys
      - \msqpq.sys
      - \mimidrv.sys
      - \e939448b28a4edc81f1f974cebf6e7d2.sys
      - \prokiller64.sys
      - \nodedriver.sys
      - \wantd_3.sys
      - \lctka.sys
      - \kapchelper_x64.sys
      - \daxin_blank4.sys
      - \a9df5964635ef8bd567ae487c3d214c4.sys
      - \wantd_6.sys
      - \ntbios.sys
      - \wantd_5.sys
      - \pciecubed.sys
      - \mimikatz.sys
      - \nqrmq.sys
      - \2.sys
      - \poortry.sys
      - \ntbios_2.sys
      - \fgme.sys
      - \telephonuafy.sys
      - \typelibde.sys
      - \daxin_blank1.sys
      - \ef0e1725aaf0c6c972593f860531a2ea.sys
      - \5a4fe297c7d42539303137b6d75b150d.sys
  condition: selection
falsepositives:
  - False positives may occur if one of the vulnerable driver names mentioned above didn't change its name between versions. So always make sure that the driver being loaded is the legitimate one and the non vulnerable version.
  - If you experience a lot of FP you could comment the driver name or its exact known legitimate location (when possible)
level: medium
license: DRL-1.1
related:
  - id: 39b64854-5497-4b57-a448-40977b8c9679
    type: derived