huntrule

Windows WinDivert Driver Load via Image or Known IMPHASHes

Detects WinDivert-related Windows driver loads using loaded image paths or known IMPHASH values.

FreeReviewedSigma · High · v2
Product
windows
Category
driver_load
Author
Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2021-07-30
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Defense Evasion → Collection

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags loading of the WinDivert-related Windows driver by matching the loaded image path names (e.g., WinDivert.sys, WinDivert64.sys and alternate filenames) or known IMPHASH values. Attackers may use this capability for packet capture, modification, blocking, or reinjection to support credential access, collection, or defense impairment. It relies on driver load telemetry that includes the loaded image path and file hashes (IMPHASH) for the kernel driver.

Reporting behind it

Related detections9 linkedT1557.001 — drag to rearrange
Suspicious LLMNR and NBT-NS Poisoning Tooling via ALPHA SPIDER (via process_creation)
Masquerading Exchange Server Impersonation via PrivExchange Relay Attack (via security)
Windows Process Creation: Command-Line Kerberos Coercion Signature via DNS SPN Spoofing
Zeek DNS detects base64 credential target pattern consistent with Kerberos DNS object spoofing
Windows DNS Query with Kerberos Coercion Signature via DNS Object SPN Spoofing
Windows LPE Attempt via TabTip CLSID Using Microsoft-Windows-DistributedCOM (Event ID 10001)
Zeek DCE/RPC efs* Operations Indicative of EFS Remote Protocol Use
Windows Process Creation: ADCSPwn Command-Line Parameters Indicating ADCS Abuse
Windows Process Creation: Impacket HackTool Binary Execution via Named Image Matches
Windows WinDivert Driver Load via Image or Known IMPHASHes
Pivot detection · T1557.001 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.