1200kmSECURITY RESEARCH

1200KM / sigma-rule

Vulnerable HackSys Extreme Vulnerable Driver Load — Sigma Rule

Sigma rule 295c9289-acee-4503-a571-8eacaef36b28. Vulnerable HackSys Extreme Vulnerable Driver Load — Sigma Rule. Detects the load of HackSys Extreme Vulnerable Driver which is an intentionally vulnerable Windows driver developed for security enthusiasts to learn and polish their exploitation skills at Kernel level and often abused by threat actors

Rule metadata and linked tags

testhighwindowsdriver_loadattack.persistenceattack.privilege-escalationattack.t1543.003

Author: Nasreddine Bencherchali (Nextron Systems). Source status: test; severity: high. Source dates: 2022-08-18 / 2024-11-23.

{
  "product": "windows",
  "category": "driver_load"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: cf1bf672c43d4441366c47bb9ce70bf3dfd3bff927951d8bf932483350dfe20a

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Vulnerable HackSys Extreme Vulnerable Driver Load
id: 295c9289-acee-4503-a571-8eacaef36b28
status: test
description: Detects the load of HackSys Extreme Vulnerable Driver which is an intentionally vulnerable Windows driver developed for security enthusiasts to learn and polish their exploitation skills at Kernel level and often abused by threat actors
references:
    - https://github.com/hacksysteam/HackSysExtremeVulnerableDriver
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-08-18
modified: 2024-11-23
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.t1543.003
logsource:
    product: windows
    category: driver_load
detection:
    selection:
        - ImageLoaded|endswith: '\HEVD.sys'
        - Hashes|contains:
              - 'IMPHASH=f26d0b110873a1c7d8c4f08fbeab89c5' # Version 3.0
              - 'IMPHASH=c46ea2e651fd5f7f716c8867c6d13594' # Version 3.0
    condition: selection
falsepositives:
    - Unlikely
level: high

Original YAML and metadata in JSON

False positives

  • Unlikely

Source references

Connected ecosystem references

Exact source-tagged techniques

Telemetry review

Read the original logsource above, then inspect the linked detection workspaces for technique-level sensor context. No per-rule telemetry equivalence is inferred.

Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.