{"id":"72cd00d6-490c-4650-86ff-1d11f491daa1","title":"Vulnerable Driver Load By Name","description":"Detects the load of known vulnerable drivers via the file name of the drivers.","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"low","date":"2022-10-03","modified":"2023-12-02","tags":["attack.persistence","attack.privilege-escalation","attack.t1543.003","attack.t1068"],"technique_ids":["T1068","T1543.003"],"logsource":{"product":"windows","category":"driver_load"},"falsepositives":["False positives may occur if one of the vulnerable driver names mentioned above didn't change its name between versions. So always make sure that the driver being loaded is the legitimate one and the non vulnerable version.","If you experience a lot of FP you could comment the driver name or its exact known legitimate location (when possible)"],"references":["https://loldrivers.io/"],"source_path":"rules/windows/driver_load/driver_load_win_vuln_drivers_names.yml","source_sha256":"a18e1df01861cbb9c99aee5de4f2544723073369a99e58b831fea437651bba3f","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/driver_load/driver_load_win_vuln_drivers_names.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Vulnerable Driver Load By Name\nid: 72cd00d6-490c-4650-86ff-1d11f491daa1\nstatus: test\ndescription: Detects the load of known vulnerable drivers via the file name of the drivers.\nreferences:\n    - https://loldrivers.io/\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2022-10-03\nmodified: 2023-12-02\ntags:\n    - attack.persistence\n    - attack.privilege-escalation\n    - attack.t1543.003\n    - attack.t1068\nlogsource:\n    product: windows\n    category: driver_load\ndetection:\n    selection:\n        ImageLoaded|endswith:\n            - '\\panmonfltx64.sys'\n            - '\\dbutil.sys'\n            - '\\fairplaykd.sys'\n            - '\\nvaudio.sys'\n            - '\\superbmc.sys'\n            - '\\bsmi.sys'\n            - '\\smarteio64.sys'\n            - '\\bwrsh.sys'\n            - '\\agent64.sys'\n            - '\\asmmap64.sys'\n            - '\\dellbios.sys'\n            - '\\chaos-rootkit.sys'\n            - '\\wcpu.sys'\n            - '\\dh_kernel.sys'\n            - '\\sbiosio64.sys'\n            - '\\bw.sys'\n            - '\\asrdrv102.sys'\n            - '\\nt6.sys'\n            - '\\mhyprot3.sys'\n            - '\\winio64c.sys'\n            - '\\asupio64.sys'\n            - '\\blackbonedrv10.sys'\n            - '\\d.sys'\n            - '\\driver7-x86.sys'\n            - '\\sfdrvx32.sys'\n            - '\\enetechio64.sys'\n            - '\\gdrv.sys'\n            - '\\sysinfodetectorx64.sys'\n            - '\\fh-ethercat_dio.sys'\n            - '\\asromgdrv.sys'\n            - '\\my.sys'\n            - '\\dcprotect.sys'\n            - '\\irec.sys'\n            - '\\gedevdrv.sys'\n            - '\\winio32a.sys'\n            - '\\gvcidrv64.sys'\n            - '\\winio32.sys'\n            - '\\bs_hwmio64.sys'\n            - '\\nstr.sys'\n            - '\\inpoutx64.sys'\n            - '\\hw.sys'\n            - '\\winio64.sys'\n            - '\\hpportiox64.sys'\n            - '\\iobitunlocker.sys'\n            - '\\b1.sys'\n            - '\\aoddriver.sys'\n            - '\\elbycdio.sys'\n            - '\\protects.sys'\n            - '\\kprocesshacker.sys'\n            - '\\speedfan.sys'\n            - '\\radhwmgr.sys'\n            - '\\iscflashx64.sys'\n            - '\\black.sys'\n            - '\\b4.sys'\n            - '\\hwos2ec10x64.sys'\n            - '\\winflash64.sys'\n            - '\\corsairllaccess64.sys'\n            - '\\bs_i2cio.sys'\n            - '\\d3.sys'\n            - '\\windows-xp-64.sys'\n            - '\\aswvmm.sys'\n            - '\\bs_i2c64.sys'\n            - '\\1.sys'\n            - '\\nchgbios2x64.sys'\n            - '\\cpuz141.sys'\n            - '\\segwindrvx64.sys'\n            - '\\tdeio64.sys'\n            - '\\ntiolib.sys'\n            - '\\gtckmdfbs.sys'\n            - '\\iomap64.sys'\n            - '\\avalueio.sys'\n            - '\\semav6msr.sys'\n            - '\\lgdcatcher.sys'\n            - '\\b.sys'\n            - '\\hwdetectng.sys'\n            - '\\nt4.sys'\n            - '\\tgsafe.sys'\n            - '\\mydrivers.sys'\n            - '\\eneio64.sys'\n            - '\\procexp.sys'\n            - '\\viragt64.sys'\n            - '\\fpcie2com.sys'\n            - '\\lenovodiagnosticsdriver.sys'\n            - '\\cp2x72c.sys'\n            - '\\kerneld.amd64'\n            - '\\bs_def64.sys'\n            - '\\piddrv.sys'\n            - '\\amifldrv64.sys'\n            - '\\cpuz_x64.sys'\n            - '\\proxy32.sys'\n            - '\\wsdkd.sys'\n            - '\\t8.sys'\n            - '\\ucorew64.sys'\n            - '\\atszio.sys'\n            - '\\lmiinfo.sys'\n            - '\\80.sys'\n            - '\\nt3.sys'\n            - '\\ngiodriver.sys'\n            - '\\lv561av.sys'\n            - '\\gpcidrv64.sys'\n            - '\\fd3b7234419fafc9bdd533f48896ed73_b816c5cd.sys'\n            - '\\rtport.sys'\n            - '\\full.sys'\n            - '\\viragt.sys'\n            - '\\fiddrv64.sys'\n            - '\\cupfixerx64.sys'\n            - '\\cpupress.sys'\n            - '\\hwos2ec7x64.sys'\n            - '\\driver7-x86-withoutdbg.sys'\n            - '\\asrdrv10.sys'\n            - '\\nvflsh64.sys'\n            - '\\asrrapidstartdrv.sys'\n            - '\\tmcomm.sys'\n            - '\\wiseunlo.sys'\n            - '\\rwdrv.sys'\n            - '\\asio64.sys'\n            - '\\nvoclock.sys'\n            - '\\panio.sys'\n            - '\\mtcbsv64.sys'\n            - '\\amigendrv64.sys'\n            - '\\capcom.sys'\n            - '\\netflt.sys'\n            - '\\phlashnt.sys'\n            - '\\dbutil_2_3.sys'\n            - '\\ni.sys'\n            - '\\ntiolib_x64.sys'\n            - '\\atszio64.sys'\n            - '\\lgcoretemp.sys'\n            - '\\lha.sys'\n            - '\\phymem64.sys'\n            - '\\dbutildrv2.sys'\n            - '\\asrdrv103.sys'\n            - '\\rtcore64.sys'\n            - '\\bs_hwmio64_w10.sys'\n            - '\\ene.sys'\n            - '\\winio64b.sys'\n            - '\\piddrv64.sys'\n            - '\\directio32.sys'\n            - '\\monitor_win10_x64.sys'\n            - '\\nt5.sys'\n            - '\\asrsmartconnectdrv.sys'\n            - '\\rtif.sys'\n            - '\\atillk64.sys'\n            - '\\directio.sys'\n            - '\\asribdrv.sys'\n            - '\\kfeco11x64.sys'\n            - '\\citmdrv_ia64.sys'\n            - '\\sysdrv3s.sys'\n            - '\\amp.sys'\n            - '\\vboxdrv.sys'\n            - '\\adv64drv.sys'\n            - '\\hostnt.sys'\n            - '\\phymem_ext64.sys'\n            - '\\echo_driver.sys'\n            - '\\winiodrv.sys'\n            - '\\pdfwkrnl.sys'\n            - '\\glckio2.sys'\n            - '\\asrdrv106.sys'\n            - '\\nscm.sys'\n            - '\\bs_rcio64.sys'\n            - '\\ncpl.sys'\n            - '\\sandra.sys'\n            - '\\fiddrv.sys'\n            - '\\hwrwdrv.sys'\n            - '\\mhyprot.sys'\n            - '\\asrsetupdrv103.sys'\n            - '\\iqvw64.sys'\n            - '\\b3.sys'\n            - '\\ssport.sys'\n            - '\\bs_def.sys'\n            - '\\computerz.sys'\n            - '\\windows8-10-32.sys'\n            - '\\nstrwsk.sys'\n            - '\\lurker.sys'\n            - '\\bsmemx64.sys'\n            - '\\wyproxy64.sys'\n            - '\\asio.sys'\n            - '\\t3.sys'\n            - '\\cpuz.sys'\n            - '\\rtkio.sys'\n            - '\\driver7-x64.sys'\n            - '\\netfilterdrv.sys'\n            - '\\ioaccess.sys'\n            - '\\testbone.sys'\n            - '\\gameink.sys'\n            - '\\kevp64.sys'\n            - '\\mhyprot2.sys'\n            - '\\se64a.sys'\n            - '\\vboxusb.sys'\n            - '\\windows7-32.sys'\n            - '\\vproeventmonitor.sys'\n            - '\\winio64a.sys'\n            - '\\asrdrv101.sys'\n            - '\\netproxydriver.sys'\n            - '\\elrawdsk.sys'\n            - '\\zam64.sys'\n            - '\\cg6kwin2k.sys'\n            - '\\asupio.sys'\n            - '\\stdcdrvws64.sys'\n            - '\\81.sys'\n            - '\\citmdrv_amd64.sys'\n            - '\\amdryzenmasterdriver.sys'\n            - '\\vmdrv.sys'\n            - '\\sysinfo.sys'\n            - '\\alsysio64.sys'\n            - '\\directio64.sys'\n            - '\\rzpnk.sys'\n            - '\\amdpowerprofiler.sys'\n            - '\\truesight.sys'\n            - '\\wirwadrv.sys'\n            - '\\phymemx64.sys'\n            - '\\msio64.sys'\n            - '\\sepdrv3_1.sys'\n            - '\\gametersafe.sys'\n            - '\\bs_rcio.sys'\n            - '\\d4.sys'\n            - '\\t.sys'\n            - '\\eio.sys'\n            - '\\nt2.sys'\n            - '\\winring0.sys'\n            - '\\physmem.sys'\n            - '\\libnicm.sys'\n            - '\\msio32.sys'\n            - '\\asrautochkupddrv.sys'\n            - '\\asio32.sys'\n            - '\\etdsupp.sys'\n            - '\\smep_namco.sys'\n            - '\\bandai.sys'\n            - '\\d2.sys'\n            - '\\magdrvamd64.sys'\n            - '\\nvflash.sys'\n            - '\\goad.sys'\n            - '\\proxy64.sys'\n            - '\\amsdk.sys'\n            - '\\kbdcap64.sys'\n            - '\\vdbsv64.sys'\n            - '\\pchunter.sys'\n            - '\\sysconp.sys'\n            - '\\dh_kernel_10.sys'\n            - '\\msrhook.sys'\n            - '\\bedaisy.sys'\n            - '\\dcr.sys'\n            - '\\panmonflt.sys'\n            - '\\bsmixp64.sys'\n            - '\\otipcibus.sys'\n            - '\\fidpcidrv.sys'\n            - '\\kfeco10x64.sys'\n            - '\\asrdrv104.sys'\n            - '\\c.sys'\n            - '\\tdklib64.sys'\n            - '\\bsmix64.sys'\n            - '\\bs_flash64.sys'\n            - '\\stdcdrv64.sys'\n            - '\\naldrv.sys'\n            - '\\ctiio64.sys'\n            - '\\bwrs.sys'\n            - '\\nicm.sys'\n            - '\\winio32b.sys'\n            - '\\paniox64.sys'\n            - '\\ecsiodriverx64.sys'\n            - '\\iomem64.sys'\n            - '\\fidpcidrv64.sys'\n            - '\\aswarpot.sys'\n            - '\\bs_rciow1064.sys'\n            - '\\asmio64.sys'\n            - '\\openlibsys.sys'\n            - '\\viraglt64.sys'\n            - '\\dbk64.sys'\n            - '\\t7.sys'\n            - '\\atlaccess.sys'\n            - '\\nbiolib_x64.sys'\n            - '\\smep_capcom.sys'\n            - '\\iqvw64e.sys'\n    condition: selection\nfalsepositives:\n    - False positives may occur if one of the vulnerable driver names mentioned above didn't change its name between versions. So always make sure that the driver being loaded is the legitimate one and the non vulnerable version.\n    - If you experience a lot of FP you could comment the driver name or its exact known legitimate location (when possible)\nlevel: low\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1068","id":"T1068","name":"Exploitation for Privilege Escalation","page":"techniques/enterprise/T1068/"},{"key":"enterprise/T1543.003","id":"T1543.003","name":"Windows Service","page":"techniques/enterprise/T1543.003/"}],"data_path":"data/detection-rules/72cd00d6-490c-4650-86ff-1d11f491daa1.json","kind":"sigma"}