win:sysmon 6
Driver loaded
The driver loaded events provides information about a driver being loaded on the system.
- Log source
- Sysmon
- Host type
- Windows (workstation, member server, domain controller)
- How to enable
- Install Sysmon with a configuration that includes the matching rule group; see sysmon-modular for an ATT&CK-mapped configuration.
- Tier, host type
- Minimum
- Techniques
- 14
- Rules depending on it
- Splunk 3, Sigma 10, Elastic 6
Why this tier
By role
| Role | Tier | Basis |
|---|---|---|
| Windows workstation | Minimum | |
| Windows member server | Minimum | |
| Windows domain controller | Minimum | |
| Windows web server (IIS), internet-facing | Minimum |
Techniques it helps detect
- T1014 Rootkit
- T1068 Exploitation for Privilege Escalation
- T1195.002 Compromise Software Supply Chain
- T1195.003 Compromise Hardware Supply Chain
- T1200 Hardware Additions
- T1205.002 Socket Filters
- T1495 Firmware Corruption
- T1542.002 Component Firmware
- T1543.003 Windows Service
- T1547.008 LSASS Driver
- T1561 Disk Wipe
- T1561.001 Disk Content Wipe
- T1561.002 Disk Structure Wipe
- T1687 Exploitation for Defense Impairment
Rules that depend on it
Splunk 3
Sigma 10
- Driver Load From A Temporary Directory by Florian Roth (Nextron Systems)
- Malicious Driver Load by Nasreddine Bencherchali (Nextron Systems)
- Malicious Driver Load By Name by Nasreddine Bencherchali (Nextron Systems)
- PUA - Process Hacker Driver Load by Florian Roth (Nextron Systems)
- PUA - System Informer Driver Load by Florian Roth (Nextron Systems)
- Vulnerable Driver Load by Nasreddine Bencherchali (Nextron Systems)
- Vulnerable Driver Load By Name by Nasreddine Bencherchali (Nextron Systems)
- Vulnerable HackSys Extreme Vulnerable Driver Load by Nasreddine Bencherchali (Nextron Systems)
- Vulnerable WinRing0 Driver Load by Florian Roth (Nextron Systems)
- WinDivert Driver Load by Florian Roth (Nextron Systems)
Elastic 6
- Scheduled Task Created by a Windows Scriptinferred
- Suspicious Image Load (taskschd.dll) from MS Officeinferred
- Suspicious RDP ActiveX Client Loadedinferred
- Suspicious Script Object Executioninferred
- Suspicious WMI Image Load from MS Officeinferred
- Windows Script Interpreter Executing Process via WMIinferred
EDR events that stand in for it
Full: the sensor event carries what this event carries. Partial: the sensor reports a subset, so it does not replace the event.
| Product | Sensor event | Fidelity | Basis |
|---|---|---|---|
| CrowdStrike Falcon sensor telemetry (FDR event_simpleName) | DriverLoad | Full | pySigma-backend-crowdstrike: driver_load -> DriverLoad |
| Microsoft Defender for Endpoint device tables | DeviceEvents | Partial | our analysis: driver load is an ActionType in DeviceEvents |