{"id":"679085d5-f427-4484-9f58-1dc30a7c426d","title":"WinDivert Driver Load","description":"Detects the load of the Windiver driver, a powerful user-mode capture/sniffing/modification/blocking/re-injection package for Windows","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2021-07-30","modified":"2024-11-23","tags":["attack.credential-access","attack.collection","attack.defense-impairment","attack.t1599.001","attack.t1557.001"],"technique_ids":["T1557.001","T1599.001"],"logsource":{"category":"driver_load","product":"windows"},"falsepositives":["Legitimate WinDivert driver usage"],"references":["https://reqrypt.org/windivert-doc.html","https://rastamouse.me/ntlm-relaying-via-cobalt-strike/"],"source_path":"rules/windows/driver_load/driver_load_win_windivert.yml","source_sha256":"25f7c09329bfe0ebb0365cea043e77b182066545786ed7a7d83a8e709a886f52","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/driver_load/driver_load_win_windivert.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: WinDivert Driver Load\nid: 679085d5-f427-4484-9f58-1dc30a7c426d\nstatus: test\ndescription: Detects the load of the Windiver driver, a powerful user-mode capture/sniffing/modification/blocking/re-injection package for Windows\nreferences:\n    - https://reqrypt.org/windivert-doc.html\n    - https://rastamouse.me/ntlm-relaying-via-cobalt-strike/\nauthor: Florian Roth (Nextron Systems)\ndate: 2021-07-30\nmodified: 2024-11-23\ntags:\n    - attack.credential-access\n    - attack.collection\n    - attack.defense-impairment\n    - attack.t1599.001\n    - attack.t1557.001\nlogsource:\n    category: driver_load\n    product: windows\ndetection:\n    selection:\n        - ImageLoaded|contains:\n              - '\\WinDivert.sys'\n              - '\\WinDivert64.sys'\n              # Other used names\n              - '\\NordDivert.sys'\n              - '\\lingtiwfp.sys'\n              - '\\eswfp.sys'\n        - Hashes|contains:\n              - 'IMPHASH=0604bb7cb4bb851e2168d5c7d9399087'\n              - 'IMPHASH=2e5f0e649d97f32b03c09e4686d0574f'\n              - 'IMPHASH=52f8aa269f69f0edad9e8fcdaedce276'\n              - 'IMPHASH=c0e5d314da39dbf65a2dbff409cc2c76'\n              - 'IMPHASH=58623490691babe8330adc81cd04a663'\n              - 'IMPHASH=8ee39b48656e4d6b8459d7ba7da7438b'\n              - 'IMPHASH=45ee545ae77e8d43fc70ede9efcd4c96'\n              - 'IMPHASH=a1b2e245acd47e4a348e1a552a02859a'\n              - 'IMPHASH=2a5f85fe4609461c6339637594fa9b0a'\n              - 'IMPHASH=6b2c6f95233c2914d1d488ee27531acc'\n              - 'IMPHASH=9f2fdd3f9ab922bbb0560a7df46f4342'\n              - 'IMPHASH=d8a719865c448b1bd2ec241e46ac1c88'\n              - 'IMPHASH=0ea54f8c9af4a2fe8367fa457f48ed38'\n              - 'IMPHASH=9d519ae0a0864d6d6ae3f8b6c9c70af6'\n              - 'IMPHASH=a74929edfc3289895e3f2885278947ae'\n              - 'IMPHASH=a66b476c2d06c370f0a53b5537f2f11e'\n              - 'IMPHASH=bdcd836a46bc2415773f6b5ea77a46e4'\n              - 'IMPHASH=c28cd6ccd83179e79dac132a553693d9'\n    condition: selection\nfalsepositives:\n    - Legitimate WinDivert driver usage\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1557.001","id":"T1557.001","name":"Name Resolution Poisoning and SMB Relay","page":"techniques/enterprise/T1557.001/"},{"key":"enterprise/T1599.001","id":"T1599.001","name":"Network Address Translation Traversal","page":"techniques/enterprise/T1599.001/"}],"data_path":"data/detection-rules/679085d5-f427-4484-9f58-1dc30a7c426d.json","kind":"sigma"}