{"id":"e76ca062-4de0-4d79-8d90-160a0d335eca","title":"PUA - Kernel Driver Utility (KDU) Execution","description":"Detects execution of the Kernel Driver Utility (KDU) tool.\nKDU can be used to bypass driver signature enforcement and load unsigned or malicious drivers into the Windows kernel.\nPotentially allowing for privilege escalation, persistence, or evasion of security controls.\n","author":"Matt Anderson, Dray Agha, Anna Pham (Huntress)","status":"experimental","level":"high","date":"2026-01-02","modified":"","tags":["attack.persistence","attack.privilege-escalation","attack.t1543.003"],"technique_ids":["T1543.003"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Legitimate driver development, testing, or administrative troubleshooting (e.g., enabling/disabling hardware)"],"references":["https://github.com/h4rmy/KDU","https://huntress.com/blog/esxi-vm-escape-exploit"],"source_path":"rules/windows/process_creation/proc_creation_win_pua_kdu_driver_tool.yml","source_sha256":"59ad77dbdc1dee031bcf4d2f8d02dca479d3def2f08f4e75309efd57e71e113a","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_pua_kdu_driver_tool.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: PUA - Kernel Driver Utility (KDU) Execution\nid: e76ca062-4de0-4d79-8d90-160a0d335eca\nstatus: experimental\ndescription: |\n    Detects execution of the Kernel Driver Utility (KDU) tool.\n    KDU can be used to bypass driver signature enforcement and load unsigned or malicious drivers into the Windows kernel.\n    Potentially allowing for privilege escalation, persistence, or evasion of security controls.\nreferences:\n    - https://github.com/h4rmy/KDU\n    - https://huntress.com/blog/esxi-vm-escape-exploit\nauthor: Matt Anderson, Dray Agha, Anna Pham (Huntress)\ndate: 2026-01-02\ntags:\n    - attack.persistence\n    - attack.privilege-escalation\n    - attack.t1543.003\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - Image|endswith:\n              - '\\kdu.exe'\n              - '\\hamakaze.exe'\n        - OriginalFileName: 'hamakaze.exe'\n    selection_cli_suspicious:\n        CommandLine|contains:\n            - '-map ' # map driver to the kernel and execute it entry point\n            - '-prv ' # optional, select vulnerability driver provider\n            - '-dse ' # write user defined value to the system DSE state flags; dse=0(disable),dse=1(enable)\n            - '-ps ' #  modify process object of given ProcessID;\n    condition: all of selection_*\nfalsepositives:\n    - Legitimate driver development, testing, or administrative troubleshooting (e.g., enabling/disabling hardware)\nlevel: high\nregression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_pua_kdu_driver_tool/info.yml\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1543.003","id":"T1543.003","name":"Windows Service","page":"techniques/enterprise/T1543.003/"}],"data_path":"data/detection-rules/e76ca062-4de0-4d79-8d90-160a0d335eca.json","kind":"sigma"}