Windows Driver Load of Known Vulnerable Drivers by File Name

ATT&CK techniques

Persistence → Priv Esc

Recon
Resource Dev
Initial Access
Execution
Persistence
- T1543.003Windows Service
Priv Esc
- T1068Exploitation for Privilege Escalation
- T1543.003Windows Service
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows system driver loads where the loaded driver file name matches a list of known vulnerable drivers. Loading a vulnerable driver can enable attackers to bypass security controls or gain elevated privileges through known weaknesses. The detection relies on driver load telemetry that records the loaded image path/name (ImageLoaded) and matches it by filename suffix.

Reporting behind it

Related detections9 linkedT1543.003 — drag to rearrange

Malicious Known Vulnerable Driver Load for BYOVD Attack

Suspicious Service Registration Loading Vulnerable Driver

Windows Malicious Driver Load Identified by Known Bad Driver File Names

Windows Malicious Driver Load by Known Hashes

Malicious Service DLL Hijack for Persistence via Lotus Blossom

Malicious TinyTurla ServiceDll Registration via svchost Group (via registry_set)

Malicious JuicyPotato Privilege Escalation Execution (UAT-7237)

Suspicious ToyMaker LAGTOY Service Creation Masquerading as WmiPrvSV via sc.exe

Malicious Service Creation With Autostart binPath via sc.exe (via process_creation)

Windows Driver Load of Known Vulnerable Drivers by File Name

Pivot detection · T1543.003 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-vulnerable-driver-load-by-known-file-name-72cd00d6

title: Windows Driver Load of Known Vulnerable Drivers by File Name
id: d5657932-b7fd-4a67-92f2-c8dad8cb2671
status: test
description: This rule flags Windows system driver loads where the loaded driver file name matches a list of known vulnerable drivers. Loading a vulnerable driver can enable attackers to bypass security controls or gain elevated privileges through known weaknesses. The detection relies on driver load telemetry that records the loaded image path/name (ImageLoaded) and matches it by filename suffix.
references:
  - https://loldrivers.io/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/driver_load/driver_load_win_vuln_drivers_names.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-10-03
modified: 2023-12-02
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1543.003
  - attack.t1068
logsource:
  product: windows
  category: driver_load
detection:
  selection:
    ImageLoaded|endswith:
      - \panmonfltx64.sys
      - \dbutil.sys
      - \fairplaykd.sys
      - \nvaudio.sys
      - \superbmc.sys
      - \bsmi.sys
      - \smarteio64.sys
      - \bwrsh.sys
      - \agent64.sys
      - \asmmap64.sys
      - \dellbios.sys
      - \chaos-rootkit.sys
      - \wcpu.sys
      - \dh_kernel.sys
      - \sbiosio64.sys
      - \bw.sys
      - \asrdrv102.sys
      - \nt6.sys
      - \mhyprot3.sys
      - \winio64c.sys
      - \asupio64.sys
      - \blackbonedrv10.sys
      - \d.sys
      - \driver7-x86.sys
      - \sfdrvx32.sys
      - \enetechio64.sys
      - \gdrv.sys
      - \sysinfodetectorx64.sys
      - \fh-ethercat_dio.sys
      - \asromgdrv.sys
      - \my.sys
      - \dcprotect.sys
      - \irec.sys
      - \gedevdrv.sys
      - \winio32a.sys
      - \gvcidrv64.sys
      - \winio32.sys
      - \bs_hwmio64.sys
      - \nstr.sys
      - \inpoutx64.sys
      - \hw.sys
      - \winio64.sys
      - \hpportiox64.sys
      - \iobitunlocker.sys
      - \b1.sys
      - \aoddriver.sys
      - \elbycdio.sys
      - \protects.sys
      - \kprocesshacker.sys
      - \speedfan.sys
      - \radhwmgr.sys
      - \iscflashx64.sys
      - \black.sys
      - \b4.sys
      - \hwos2ec10x64.sys
      - \winflash64.sys
      - \corsairllaccess64.sys
      - \bs_i2cio.sys
      - \d3.sys
      - \windows-xp-64.sys
      - \aswvmm.sys
      - \bs_i2c64.sys
      - \1.sys
      - \nchgbios2x64.sys
      - \cpuz141.sys
      - \segwindrvx64.sys
      - \tdeio64.sys
      - \ntiolib.sys
      - \gtckmdfbs.sys
      - \iomap64.sys
      - \avalueio.sys
      - \semav6msr.sys
      - \lgdcatcher.sys
      - \b.sys
      - \hwdetectng.sys
      - \nt4.sys
      - \tgsafe.sys
      - \mydrivers.sys
      - \eneio64.sys
      - \procexp.sys
      - \viragt64.sys
      - \fpcie2com.sys
      - \lenovodiagnosticsdriver.sys
      - \cp2x72c.sys
      - \kerneld.amd64
      - \bs_def64.sys
      - \piddrv.sys
      - \amifldrv64.sys
      - \cpuz_x64.sys
      - \proxy32.sys
      - \wsdkd.sys
      - \t8.sys
      - \ucorew64.sys
      - \atszio.sys
      - \lmiinfo.sys
      - \80.sys
      - \nt3.sys
      - \ngiodriver.sys
      - \lv561av.sys
      - \gpcidrv64.sys
      - \fd3b7234419fafc9bdd533f48896ed73_b816c5cd.sys
      - \rtport.sys
      - \full.sys
      - \viragt.sys
      - \fiddrv64.sys
      - \cupfixerx64.sys
      - \cpupress.sys
      - \hwos2ec7x64.sys
      - \driver7-x86-withoutdbg.sys
      - \asrdrv10.sys
      - \nvflsh64.sys
      - \asrrapidstartdrv.sys
      - \tmcomm.sys
      - \wiseunlo.sys
      - \rwdrv.sys
      - \asio64.sys
      - \nvoclock.sys
      - \panio.sys
      - \mtcbsv64.sys
      - \amigendrv64.sys
      - \capcom.sys
      - \netflt.sys
      - \phlashnt.sys
      - \dbutil_2_3.sys
      - \ni.sys
      - \ntiolib_x64.sys
      - \atszio64.sys
      - \lgcoretemp.sys
      - \lha.sys
      - \phymem64.sys
      - \dbutildrv2.sys
      - \asrdrv103.sys
      - \rtcore64.sys
      - \bs_hwmio64_w10.sys
      - \ene.sys
      - \winio64b.sys
      - \piddrv64.sys
      - \directio32.sys
      - \monitor_win10_x64.sys
      - \nt5.sys
      - \asrsmartconnectdrv.sys
      - \rtif.sys
      - \atillk64.sys
      - \directio.sys
      - \asribdrv.sys
      - \kfeco11x64.sys
      - \citmdrv_ia64.sys
      - \sysdrv3s.sys
      - \amp.sys
      - \vboxdrv.sys
      - \adv64drv.sys
      - \hostnt.sys
      - \phymem_ext64.sys
      - \echo_driver.sys
      - \winiodrv.sys
      - \pdfwkrnl.sys
      - \glckio2.sys
      - \asrdrv106.sys
      - \nscm.sys
      - \bs_rcio64.sys
      - \ncpl.sys
      - \sandra.sys
      - \fiddrv.sys
      - \hwrwdrv.sys
      - \mhyprot.sys
      - \asrsetupdrv103.sys
      - \iqvw64.sys
      - \b3.sys
      - \ssport.sys
      - \bs_def.sys
      - \computerz.sys
      - \windows8-10-32.sys
      - \nstrwsk.sys
      - \lurker.sys
      - \bsmemx64.sys
      - \wyproxy64.sys
      - \asio.sys
      - \t3.sys
      - \cpuz.sys
      - \rtkio.sys
      - \driver7-x64.sys
      - \netfilterdrv.sys
      - \ioaccess.sys
      - \testbone.sys
      - \gameink.sys
      - \kevp64.sys
      - \mhyprot2.sys
      - \se64a.sys
      - \vboxusb.sys
      - \windows7-32.sys
      - \vproeventmonitor.sys
      - \winio64a.sys
      - \asrdrv101.sys
      - \netproxydriver.sys
      - \elrawdsk.sys
      - \zam64.sys
      - \cg6kwin2k.sys
      - \asupio.sys
      - \stdcdrvws64.sys
      - \81.sys
      - \citmdrv_amd64.sys
      - \amdryzenmasterdriver.sys
      - \vmdrv.sys
      - \sysinfo.sys
      - \alsysio64.sys
      - \directio64.sys
      - \rzpnk.sys
      - \amdpowerprofiler.sys
      - \truesight.sys
      - \wirwadrv.sys
      - \phymemx64.sys
      - \msio64.sys
      - \sepdrv3_1.sys
      - \gametersafe.sys
      - \bs_rcio.sys
      - \d4.sys
      - \t.sys
      - \eio.sys
      - \nt2.sys
      - \winring0.sys
      - \physmem.sys
      - \libnicm.sys
      - \msio32.sys
      - \asrautochkupddrv.sys
      - \asio32.sys
      - \etdsupp.sys
      - \smep_namco.sys
      - \bandai.sys
      - \d2.sys
      - \magdrvamd64.sys
      - \nvflash.sys
      - \goad.sys
      - \proxy64.sys
      - \amsdk.sys
      - \kbdcap64.sys
      - \vdbsv64.sys
      - \pchunter.sys
      - \sysconp.sys
      - \dh_kernel_10.sys
      - \msrhook.sys
      - \bedaisy.sys
      - \dcr.sys
      - \panmonflt.sys
      - \bsmixp64.sys
      - \otipcibus.sys
      - \fidpcidrv.sys
      - \kfeco10x64.sys
      - \asrdrv104.sys
      - \c.sys
      - \tdklib64.sys
      - \bsmix64.sys
      - \bs_flash64.sys
      - \stdcdrv64.sys
      - \naldrv.sys
      - \ctiio64.sys
      - \bwrs.sys
      - \nicm.sys
      - \winio32b.sys
      - \paniox64.sys
      - \ecsiodriverx64.sys
      - \iomem64.sys
      - \fidpcidrv64.sys
      - \aswarpot.sys
      - \bs_rciow1064.sys
      - \asmio64.sys
      - \openlibsys.sys
      - \viraglt64.sys
      - \dbk64.sys
      - \t7.sys
      - \atlaccess.sys
      - \nbiolib_x64.sys
      - \smep_capcom.sys
      - \iqvw64e.sys
  condition: selection
falsepositives:
  - False positives may occur if one of the vulnerable driver names mentioned above didn't change its name between versions. So always make sure that the driver being loaded is the legitimate one and the non vulnerable version.
  - If you experience a lot of FP you could comment the driver name or its exact known legitimate location (when possible)
level: low
license: DRL-1.1
related:
  - id: 72cd00d6-490c-4650-86ff-1d11f491daa1
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL