Windows WinDivert Driver Load Detection via Loaded Driver Image or Known ImpHash

Detects WinDivert-related Windows driver loads using loaded image paths or known IMPHASH values.

FreeUnreviewedSigmahighv1

windows-windivert-driver-load-detection-via-loaded-driver-image-or-known-imphash-679085d5

title: Windows WinDivert Driver Load Detection via Loaded Driver Image or Known ImpHash
id: a6043d93-90f0-44d6-8784-63e81532370d
status: test
description: This rule flags the loading of the WinDivert family of Windows drivers by matching specific loaded driver image paths (e.g., WinDivert.sys/WinDivert64.sys and related variants) or known import hashes. Attackers may use such drivers to intercept, modify, or block network traffic, which can support collection and defense-impairment scenarios. The detection relies on driver load telemetry that records the loaded image name/path and associated file hashes (IMPHASH).
references:
  - https://reqrypt.org/windivert-doc.html
  - https://rastamouse.me/ntlm-relaying-via-cobalt-strike/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/driver_load/driver_load_win_windivert.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-07-30
modified: 2024-11-23
tags:
  - attack.credential-access
  - attack.collection
  - attack.defense-impairment
  - attack.t1599.001
  - attack.t1557.001
logsource:
  category: driver_load
  product: windows
detection:
  selection:
    - ImageLoaded|contains:
        - \WinDivert.sys
        - \WinDivert64.sys
        - \NordDivert.sys
        - \lingtiwfp.sys
        - \eswfp.sys
    - Hashes|contains:
        - IMPHASH=0604bb7cb4bb851e2168d5c7d9399087
        - IMPHASH=2e5f0e649d97f32b03c09e4686d0574f
        - IMPHASH=52f8aa269f69f0edad9e8fcdaedce276
        - IMPHASH=c0e5d314da39dbf65a2dbff409cc2c76
        - IMPHASH=58623490691babe8330adc81cd04a663
        - IMPHASH=8ee39b48656e4d6b8459d7ba7da7438b
        - IMPHASH=45ee545ae77e8d43fc70ede9efcd4c96
        - IMPHASH=a1b2e245acd47e4a348e1a552a02859a
        - IMPHASH=2a5f85fe4609461c6339637594fa9b0a
        - IMPHASH=6b2c6f95233c2914d1d488ee27531acc
        - IMPHASH=9f2fdd3f9ab922bbb0560a7df46f4342
        - IMPHASH=d8a719865c448b1bd2ec241e46ac1c88
        - IMPHASH=0ea54f8c9af4a2fe8367fa457f48ed38
        - IMPHASH=9d519ae0a0864d6d6ae3f8b6c9c70af6
        - IMPHASH=a74929edfc3289895e3f2885278947ae
        - IMPHASH=a66b476c2d06c370f0a53b5537f2f11e
        - IMPHASH=bdcd836a46bc2415773f6b5ea77a46e4
        - IMPHASH=c28cd6ccd83179e79dac132a553693d9
  condition: selection
falsepositives:
  - Legitimate WinDivert driver usage
level: high
license: DRL-1.1
related:
  - id: 679085d5-f427-4484-9f58-1dc30a7c426d
    type: derived

What it detects

This rule flags the loading of the WinDivert family of Windows drivers by matching specific loaded driver image paths (e.g., WinDivert.sys/WinDivert64.sys and related variants) or known import hashes. Attackers may use such drivers to intercept, modify, or block network traffic, which can support collection and defense-impairment scenarios. The detection relies on driver load telemetry that records the loaded image name/path and associated file hashes (IMPHASH).

Known false positives

Legitimate WinDivert driver usage

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.