huntrule

Windows Malicious Driver Load Identified by Known Bad Driver File Names

Alerts when Windows loads a driver whose file name matches a curated list of known malicious/suspicious drivers.

FreeReviewedSigma · Medium · v2
Product
windows
Category
driver_load
Author
Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2022-10-03
Updated
2026-07-31
AnalysisDetection
title: Windows Malicious Driver Load Identified by Known Bad Driver File Names
id: 0aff679d-fc86-4367-8a29-67e764c01921
status: test
description: This rule flags Windows driver loads when the loaded image path ends with a filename from a hardcoded set of known malicious driver names. Loading a malicious or vulnerable driver can provide attackers with persistence and/or elevated privileges by executing code in kernel mode. Telemetry relies on driver-load events that provide the loaded image path or filename (ImageLoaded).
references:
  - https://loldrivers.io/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/driver_load/driver_load_win_mal_drivers_names.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-10-03
modified: 2023-12-02
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1543.003
  - attack.t1068
logsource:
  product: windows
  category: driver_load
detection:
  selection:
    ImageLoaded|endswith:
      - \wfshbr64.sys
      - \ktmutil7odm.sys
      - \ktes.sys
      - \a26363e7b02b13f2b8d697abb90cd5c3.sys
      - \kt2.sys
      - \4748696211bd56c2d93c21cab91e82a5.sys
      - \malicious.sys
      - \a236e7d654cd932b7d11cb604629a2d0.sys
      - \spwizimgvt.sys
      - \c94f405c5929cfcccc8ad00b42c95083.sys
      - \fur.sys
      - \wantd.sys
      - \windbg.sys
      - \4118b86e490aed091b1a219dba45f332.sys
      - \gmer64.sys
      - \1fc7aeeff3ab19004d2e53eae8160ab1.sys
      - \poortry2.sys
      - \wintapix.sys
      - \daxin_blank6.sys
      - \6771b13a53b9c7449d4891e427735ea2.sys
      - \blacklotus_driver.sys
      - \air_system10.sys
      - \dkrtk.sys
      - \7.sys
      - \sense5ext.sys
      - \ktgn.sys
      - \ndislan.sys
      - \nlslexicons0024uvn.sys
      - \be6318413160e589080df02bb3ca6e6a.sys
      - \4.sys
      - \wantd_2.sys
      - \e29f6311ae87542b3d693c1f38e4e3ad.sys
      - \daxin_blank3.sys
      - \gftkyj64.sys
      - \daxin_blank2.sys
      - \wantd_4.sys
      - \reddriver.sys
      - \834761775.sys
      - \mlgbbiicaihflrnh.sys
      - \mjj0ge.sys
      - \daxin_blank.sys
      - \daxin_blank5.sys
      - \poortry1.sys
      - \msqpq.sys
      - \mimidrv.sys
      - \e939448b28a4edc81f1f974cebf6e7d2.sys
      - \prokiller64.sys
      - \nodedriver.sys
      - \wantd_3.sys
      - \lctka.sys
      - \kapchelper_x64.sys
      - \daxin_blank4.sys
      - \a9df5964635ef8bd567ae487c3d214c4.sys
      - \wantd_6.sys
      - \ntbios.sys
      - \wantd_5.sys
      - \pciecubed.sys
      - \mimikatz.sys
      - \nqrmq.sys
      - \2.sys
      - \poortry.sys
      - \ntbios_2.sys
      - \fgme.sys
      - \telephonuafy.sys
      - \typelibde.sys
      - \daxin_blank1.sys
      - \ef0e1725aaf0c6c972593f860531a2ea.sys
      - \5a4fe297c7d42539303137b6d75b150d.sys
  condition: selection
falsepositives:
  - False positives may occur if one of the vulnerable driver names mentioned above didn't change its name between versions. So always make sure that the driver being loaded is the legitimate one and the non vulnerable version.
  - If you experience a lot of FP you could comment the driver name or its exact known legitimate location (when possible)
level: medium
license: DRL-1.1
related:
  - id: 39b64854-5497-4b57-a448-40977b8c9679
    type: derived