Windows WinRing0 Driver Load via IMPhash or Image Path Match

title: Windows WinRing0 Driver Load via IMPhash or Image Path Match
id: fd7dc47a-c9a9-44b3-87a6-33d7eac2641e
status: test
description: This rule flags Windows events where a WinRing0 driver module is loaded, based on either a specific import hash value or an image filename/path ending in common WinRing0 binaries. Loading such drivers is significant because kernel-mode drivers can enable persistence and privilege escalation beyond user-mode controls. The detection relies on driver load telemetry containing the loaded image path and, when available, the module import hash.
references:
  - https://github.com/xmrig/xmrig/tree/master/bin/WinRing0
  - https://www.rapid7.com/blog/post/2021/12/13/driver-based-attacks-past-and-present/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/driver_load/driver_load_win_vuln_winring0_driver.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-07-26
modified: 2024-11-23
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1543.003
logsource:
  product: windows
  category: driver_load
detection:
  selection:
    - Hashes|contains: IMPHASH=D41FA95D4642DC981F10DE36F4DC8CD7
    - ImageLoaded|endswith:
        - \WinRing0x64.sys
        - \WinRing0.sys
        - \WinRing0.dll
        - \WinRing0x64.dll
        - \winring00x64.sys
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 1a42dfa6-6cb2-4df9-9b48-295be477e835
    type: derived