Windows WinDivert Driver Load via Image or Known IMPHASHes

Detects WinDivert-related Windows driver loads using loaded image paths or known IMPHASH values.

FreeReviewedSigma · High · v2

Product: windows
Category: driver_load
Author: Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2021-07-30
Updated: 2026-07-31

ATT&CK techniques

Defense Evasion → Collection

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1599.001Network Address Translation Traversal
Cred Access
- T1557.001Name Resolution Poisoning and SMB Relay
Discovery
Lateral Movement
Collection
- T1557.001Name Resolution Poisoning and SMB Relay
C2
Exfiltration
Impact

What it detects

This rule flags loading of the WinDivert-related Windows driver by matching the loaded image path names (e.g., WinDivert.sys, WinDivert64.sys and alternate filenames) or known IMPHASH values. Attackers may use this capability for packet capture, modification, blocking, or reinjection to support credential access, collection, or defense impairment. It relies on driver load telemetry that includes the loaded image path and file hashes (IMPHASH) for the kernel driver.

Reporting behind it

Related detections9 linkedT1557.001 — drag to rearrange

Suspicious LLMNR and NBT-NS Poisoning Tooling via ALPHA SPIDER (via process_creation)

Masquerading Exchange Server Impersonation via PrivExchange Relay Attack (via security)

Windows Process Creation: Command-Line Kerberos Coercion Signature via DNS SPN Spoofing

Zeek DNS detects base64 credential target pattern consistent with Kerberos DNS object spoofing

Windows DNS Query with Kerberos Coercion Signature via DNS Object SPN Spoofing

Windows LPE Attempt via TabTip CLSID Using Microsoft-Windows-DistributedCOM (Event ID 10001)

Zeek DCE/RPC efs* Operations Indicative of EFS Remote Protocol Use

Windows Process Creation: ADCSPwn Command-Line Parameters Indicating ADCS Abuse

Windows Process Creation: Impacket HackTool Binary Execution via Named Image Matches

Windows WinDivert Driver Load via Image or Known IMPHASHes

Pivot detection · T1557.001 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-windivert-driver-load-detection-via-loaded-driver-image-or-known-imphash-679085d5

title: Windows WinDivert Driver Load via Image or Known IMPHASHes
id: a6043d93-90f0-44d6-8784-63e81532370d
status: test
description: This rule flags loading of the WinDivert-related Windows driver by matching the loaded image path names (e.g., WinDivert.sys, WinDivert64.sys and alternate filenames) or known IMPHASH values. Attackers may use this capability for packet capture, modification, blocking, or reinjection to support credential access, collection, or defense impairment. It relies on driver load telemetry that includes the loaded image path and file hashes (IMPHASH) for the kernel driver.
references:
  - https://reqrypt.org/windivert-doc.html
  - https://rastamouse.me/ntlm-relaying-via-cobalt-strike/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/driver_load/driver_load_win_windivert.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-07-30
modified: 2024-11-23
tags:
  - attack.credential-access
  - attack.collection
  - attack.defense-impairment
  - attack.t1599.001
  - attack.t1557.001
logsource:
  category: driver_load
  product: windows
detection:
  selection:
    - ImageLoaded|contains:
        - \WinDivert.sys
        - \WinDivert64.sys
        - \NordDivert.sys
        - \lingtiwfp.sys
        - \eswfp.sys
    - Hashes|contains:
        - IMPHASH=0604bb7cb4bb851e2168d5c7d9399087
        - IMPHASH=2e5f0e649d97f32b03c09e4686d0574f
        - IMPHASH=52f8aa269f69f0edad9e8fcdaedce276
        - IMPHASH=c0e5d314da39dbf65a2dbff409cc2c76
        - IMPHASH=58623490691babe8330adc81cd04a663
        - IMPHASH=8ee39b48656e4d6b8459d7ba7da7438b
        - IMPHASH=45ee545ae77e8d43fc70ede9efcd4c96
        - IMPHASH=a1b2e245acd47e4a348e1a552a02859a
        - IMPHASH=2a5f85fe4609461c6339637594fa9b0a
        - IMPHASH=6b2c6f95233c2914d1d488ee27531acc
        - IMPHASH=9f2fdd3f9ab922bbb0560a7df46f4342
        - IMPHASH=d8a719865c448b1bd2ec241e46ac1c88
        - IMPHASH=0ea54f8c9af4a2fe8367fa457f48ed38
        - IMPHASH=9d519ae0a0864d6d6ae3f8b6c9c70af6
        - IMPHASH=a74929edfc3289895e3f2885278947ae
        - IMPHASH=a66b476c2d06c370f0a53b5537f2f11e
        - IMPHASH=bdcd836a46bc2415773f6b5ea77a46e4
        - IMPHASH=c28cd6ccd83179e79dac132a553693d9
  condition: selection
falsepositives:
  - Legitimate WinDivert driver usage
level: high
license: DRL-1.1
related:
  - id: 679085d5-f427-4484-9f58-1dc30a7c426d
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL