huntrule

Windows: WinRing0 Driver Load via Image Hash and File Name Match

Alerts on Windows driver loads matching WinRing0 modules by IMPhash or expected WinRing0 filenames.

FreeReviewedSigma · High · v2
Product
windows
Category
driver_load
Author
Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2022-07-26
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Persistence → Priv Esc

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags the loading of WinRing0 driver binaries when the loaded image matches a specific imphash and the filename ends with common WinRing0 variants. Loading these drivers can enable attackers to gain low-level access for persistence or privilege escalation. It relies on Windows driver load telemetry that includes image hash (imphash) and the loaded image path or filename.

Reporting behind it

Related detections9 linkedT1543.003 — drag to rearrange
Malicious Service DLL Hijack for Persistence via Lotus Blossom
Malicious TinyTurla ServiceDll Registration via svchost Group (via registry_set)
Suspicious ToyMaker LAGTOY Service Creation Masquerading as WmiPrvSV via sc.exe
Malicious Service Creation With Autostart binPath via sc.exe (via process_creation)
Malicious svchost Service Creation for TinyTurla Persistence (via process_creation)
Malicious Service Creation Masquerading as nslookup (via process_creation)
Interactive Service Creation Executing cmd via sc.exe
Malicious Known Vulnerable Driver Load for BYOVD Attack
Malicious ValleyRAT KernelQuick Rootkit Service and Shellcode Store Registry Keys
Windows: WinRing0 Driver Load via Image Hash and File Name Match
Pivot detection · T1543.003 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.