huntrule

Windows Driver Load of Known Vulnerable Drivers by File Name

Alerts when Windows loads a driver whose filename matches a list of known vulnerable drivers.

FreeReviewedSigma · Low · v2
Product
windows
Category
driver_load
Author
Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2022-10-03
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Persistence → Priv Esc

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Windows system driver loads where the loaded driver file name matches a list of known vulnerable drivers. Loading a vulnerable driver can enable attackers to bypass security controls or gain elevated privileges through known weaknesses. The detection relies on driver load telemetry that records the loaded image path/name (ImageLoaded) and matches it by filename suffix.

Reporting behind it

Related detections9 linkedT1068 — drag to rearrange
Malicious Vulnerable Driver Load by GentleKiller BYOVD EDR Killer
Malicious Known Vulnerable Driver Load for BYOVD Attack
Suspicious Service Registration Loading Vulnerable Driver
Windows Malicious Driver Load Identified by Known Bad Driver File Names
Windows Malicious Driver Load by Known Hashes
Malicious Service Created With Binary Path in ProgramData
Suspicious Modification of Privileged Authentication Binaries via Kernel LPE
Malicious Abyss Locker wmihelper SSH Backdoor Deployment (via file_event)
Malicious EDR Evasion Driver Load from AnyDesk Directory via k.sys (via image_load)
Windows Driver Load of Known Vulnerable Drivers by File Name
Pivot detection · T1068 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.