Windows Vulnerable Driver Load by Known File Name
Alerts when Windows loads a driver whose filename matches a list of known vulnerable drivers.
FreeUnreviewedSigmalowv1
windows-vulnerable-driver-load-by-known-file-name-72cd00d6
title: Windows Vulnerable Driver Load by Known File Name
id: d5657932-b7fd-4a67-92f2-c8dad8cb2671
status: test
description: This rule flags Windows systems when a driver is loaded whose file name matches a hardcoded set of known vulnerable driver names. Loading a vulnerable driver can provide an attacker a path to persistence or privilege escalation by abusing the driver's known weaknesses. It relies on driver load telemetry that includes the loaded driver image path/name (ImageLoaded) and matches on known file name suffixes.
references:
- https://loldrivers.io/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/driver_load/driver_load_win_vuln_drivers_names.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-10-03
modified: 2023-12-02
tags:
- attack.persistence
- attack.privilege-escalation
- attack.t1543.003
- attack.t1068
logsource:
product: windows
category: driver_load
detection:
selection:
ImageLoaded|endswith:
- \panmonfltx64.sys
- \dbutil.sys
- \fairplaykd.sys
- \nvaudio.sys
- \superbmc.sys
- \bsmi.sys
- \smarteio64.sys
- \bwrsh.sys
- \agent64.sys
- \asmmap64.sys
- \dellbios.sys
- \chaos-rootkit.sys
- \wcpu.sys
- \dh_kernel.sys
- \sbiosio64.sys
- \bw.sys
- \asrdrv102.sys
- \nt6.sys
- \mhyprot3.sys
- \winio64c.sys
- \asupio64.sys
- \blackbonedrv10.sys
- \d.sys
- \driver7-x86.sys
- \sfdrvx32.sys
- \enetechio64.sys
- \gdrv.sys
- \sysinfodetectorx64.sys
- \fh-ethercat_dio.sys
- \asromgdrv.sys
- \my.sys
- \dcprotect.sys
- \irec.sys
- \gedevdrv.sys
- \winio32a.sys
- \gvcidrv64.sys
- \winio32.sys
- \bs_hwmio64.sys
- \nstr.sys
- \inpoutx64.sys
- \hw.sys
- \winio64.sys
- \hpportiox64.sys
- \iobitunlocker.sys
- \b1.sys
- \aoddriver.sys
- \elbycdio.sys
- \protects.sys
- \kprocesshacker.sys
- \speedfan.sys
- \radhwmgr.sys
- \iscflashx64.sys
- \black.sys
- \b4.sys
- \hwos2ec10x64.sys
- \winflash64.sys
- \corsairllaccess64.sys
- \bs_i2cio.sys
- \d3.sys
- \windows-xp-64.sys
- \aswvmm.sys
- \bs_i2c64.sys
- \1.sys
- \nchgbios2x64.sys
- \cpuz141.sys
- \segwindrvx64.sys
- \tdeio64.sys
- \ntiolib.sys
- \gtckmdfbs.sys
- \iomap64.sys
- \avalueio.sys
- \semav6msr.sys
- \lgdcatcher.sys
- \b.sys
- \hwdetectng.sys
- \nt4.sys
- \tgsafe.sys
- \mydrivers.sys
- \eneio64.sys
- \procexp.sys
- \viragt64.sys
- \fpcie2com.sys
- \lenovodiagnosticsdriver.sys
- \cp2x72c.sys
- \kerneld.amd64
- \bs_def64.sys
- \piddrv.sys
- \amifldrv64.sys
- \cpuz_x64.sys
- \proxy32.sys
- \wsdkd.sys
- \t8.sys
- \ucorew64.sys
- \atszio.sys
- \lmiinfo.sys
- \80.sys
- \nt3.sys
- \ngiodriver.sys
- \lv561av.sys
- \gpcidrv64.sys
- \fd3b7234419fafc9bdd533f48896ed73_b816c5cd.sys
- \rtport.sys
- \full.sys
- \viragt.sys
- \fiddrv64.sys
- \cupfixerx64.sys
- \cpupress.sys
- \hwos2ec7x64.sys
- \driver7-x86-withoutdbg.sys
- \asrdrv10.sys
- \nvflsh64.sys
- \asrrapidstartdrv.sys
- \tmcomm.sys
- \wiseunlo.sys
- \rwdrv.sys
- \asio64.sys
- \nvoclock.sys
- \panio.sys
- \mtcbsv64.sys
- \amigendrv64.sys
- \capcom.sys
- \netflt.sys
- \phlashnt.sys
- \dbutil_2_3.sys
- \ni.sys
- \ntiolib_x64.sys
- \atszio64.sys
- \lgcoretemp.sys
- \lha.sys
- \phymem64.sys
- \dbutildrv2.sys
- \asrdrv103.sys
- \rtcore64.sys
- \bs_hwmio64_w10.sys
- \ene.sys
- \winio64b.sys
- \piddrv64.sys
- \directio32.sys
- \monitor_win10_x64.sys
- \nt5.sys
- \asrsmartconnectdrv.sys
- \rtif.sys
- \atillk64.sys
- \directio.sys
- \asribdrv.sys
- \kfeco11x64.sys
- \citmdrv_ia64.sys
- \sysdrv3s.sys
- \amp.sys
- \vboxdrv.sys
- \adv64drv.sys
- \hostnt.sys
- \phymem_ext64.sys
- \echo_driver.sys
- \winiodrv.sys
- \pdfwkrnl.sys
- \glckio2.sys
- \asrdrv106.sys
- \nscm.sys
- \bs_rcio64.sys
- \ncpl.sys
- \sandra.sys
- \fiddrv.sys
- \hwrwdrv.sys
- \mhyprot.sys
- \asrsetupdrv103.sys
- \iqvw64.sys
- \b3.sys
- \ssport.sys
- \bs_def.sys
- \computerz.sys
- \windows8-10-32.sys
- \nstrwsk.sys
- \lurker.sys
- \bsmemx64.sys
- \wyproxy64.sys
- \asio.sys
- \t3.sys
- \cpuz.sys
- \rtkio.sys
- \driver7-x64.sys
- \netfilterdrv.sys
- \ioaccess.sys
- \testbone.sys
- \gameink.sys
- \kevp64.sys
- \mhyprot2.sys
- \se64a.sys
- \vboxusb.sys
- \windows7-32.sys
- \vproeventmonitor.sys
- \winio64a.sys
- \asrdrv101.sys
- \netproxydriver.sys
- \elrawdsk.sys
- \zam64.sys
- \cg6kwin2k.sys
- \asupio.sys
- \stdcdrvws64.sys
- \81.sys
- \citmdrv_amd64.sys
- \amdryzenmasterdriver.sys
- \vmdrv.sys
- \sysinfo.sys
- \alsysio64.sys
- \directio64.sys
- \rzpnk.sys
- \amdpowerprofiler.sys
- \truesight.sys
- \wirwadrv.sys
- \phymemx64.sys
- \msio64.sys
- \sepdrv3_1.sys
- \gametersafe.sys
- \bs_rcio.sys
- \d4.sys
- \t.sys
- \eio.sys
- \nt2.sys
- \winring0.sys
- \physmem.sys
- \libnicm.sys
- \msio32.sys
- \asrautochkupddrv.sys
- \asio32.sys
- \etdsupp.sys
- \smep_namco.sys
- \bandai.sys
- \d2.sys
- \magdrvamd64.sys
- \nvflash.sys
- \goad.sys
- \proxy64.sys
- \amsdk.sys
- \kbdcap64.sys
- \vdbsv64.sys
- \pchunter.sys
- \sysconp.sys
- \dh_kernel_10.sys
- \msrhook.sys
- \bedaisy.sys
- \dcr.sys
- \panmonflt.sys
- \bsmixp64.sys
- \otipcibus.sys
- \fidpcidrv.sys
- \kfeco10x64.sys
- \asrdrv104.sys
- \c.sys
- \tdklib64.sys
- \bsmix64.sys
- \bs_flash64.sys
- \stdcdrv64.sys
- \naldrv.sys
- \ctiio64.sys
- \bwrs.sys
- \nicm.sys
- \winio32b.sys
- \paniox64.sys
- \ecsiodriverx64.sys
- \iomem64.sys
- \fidpcidrv64.sys
- \aswarpot.sys
- \bs_rciow1064.sys
- \asmio64.sys
- \openlibsys.sys
- \viraglt64.sys
- \dbk64.sys
- \t7.sys
- \atlaccess.sys
- \nbiolib_x64.sys
- \smep_capcom.sys
- \iqvw64e.sys
condition: selection
falsepositives:
- False positives may occur if one of the vulnerable driver names mentioned above didn't change its name between versions. So always make sure that the driver being loaded is the legitimate one and the non vulnerable version.
- If you experience a lot of FP you could comment the driver name or its exact known legitimate location (when possible)
level: low
license: DRL-1.1
related:
- id: 72cd00d6-490c-4650-86ff-1d11f491daa1
type: derived
What it detects
This rule flags Windows systems when a driver is loaded whose file name matches a hardcoded set of known vulnerable driver names. Loading a vulnerable driver can provide an attacker a path to persistence or privilege escalation by abusing the driver's known weaknesses. It relies on driver load telemetry that includes the loaded driver image path/name (ImageLoaded) and matches on known file name suffixes.
Known false positives
- False positives may occur if one of the vulnerable driver names mentioned above didn't change its name between versions. So always make sure that the driver being loaded is the legitimate one and the non vulnerable version.
- If you experience a lot of FP you could comment the driver name or its exact known legitimate location (when possible)
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.