Windows Security 4673: SeLoadDriverPrivilege Used to Load/Unload Kernel Drivers

title: "Windows Security 4673: SeLoadDriverPrivilege Used to Load/Unload Kernel Drivers"
id: 988ced64-ea12-4e7d-8a03-3ea28331cc23
status: test
description: This rule identifies Windows Security Event ID 4673 where the PrivilegeList includes SeLoadDriverPrivilege, indicating a process attempted an operation requiring the right to load or unload device drivers. Such activity matters because attackers may use driver loading capabilities to execute code in kernel mode. The detection relies on Security audit telemetry that logs privilege use for Event ID 4673 and filters out several common, known process paths from the match scope.
references:
  - https://web.archive.org/web/20230331181619/https://blog.dylan.codes/evading-sysmon-and-windows-event-logging/
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4673
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_user_driver_loaded.yml
author: xknow (@xknow_infosec), xorxes (@xor_xes), Huntrule Team
date: 2019-04-08
modified: 2026-06-29
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  product: windows
  service: security
detection:
  selection_1:
    EventID: 4673
    PrivilegeList: SeLoadDriverPrivilege
    Service: "-"
  filter_main_exact:
    ProcessName:
      - C:\Windows\explorer.exe
      - C:\Windows\HelpPane.exe
      - C:\Windows\ImmersiveControlPanel\SystemSettings.exe
      - C:\Windows\System32\Dism.exe
      - C:\Windows\System32\fltMC.exe
      - C:\Windows\System32\mmc.exe
      - C:\Windows\System32\rundll32.exe
      - C:\Windows\System32\RuntimeBroker.exe
      - C:\Windows\System32\ShellHost.exe
      - C:\Windows\System32\svchost.exe
      - C:\Windows\System32\SystemSettingsBroker.exe
      - C:\Windows\System32\wimserv.exe
  filter_optional_others:
    ProcessName|endswith:
      - \AppData\Local\Microsoft\Teams\current\Teams.exe
      - \Google\Chrome\Application\chrome.exe
      - \procexp.exe
      - \procexp64.exe
      - \procexp64a.exe
      - \procmon.exe
      - \procmon64.exe
      - \procmon64a.exe
  filter_main_startswith:
    ProcessName|startswith: C:\Program Files\WindowsApps\Microsoft
  filter_optional_dropbox:
    ProcessName|startswith:
      - C:\Program Files (x86)\Dropbox\
      - C:\Program Files\Dropbox\
    ProcessName|endswith: \Dropbox.exe
  condition: selection_1 and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Other legimate tools loading drivers. Including but not limited to, Sysinternals, CPU-Z, AVs etc. A baseline needs to be created according to the used products and allowed tools. A good thing to do is to try and exclude users who are allowed to load drivers.
level: medium
license: DRL-1.1
related:
  - id: f63508a0-c809-4435-b3be-ed819394d612
    type: derived