Vulnerable Driver Load By Name — Sigma Rule

Rule metadata and linked tags

Author: Nasreddine Bencherchali (Nextron Systems). Source status: test; severity: low. Source dates: 2022-10-03 / 2023-12-02.

{
  "product": "windows",
  "category": "driver_load"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: a18e1df01861cbb9c99aee5de4f2544723073369a99e58b831fea437651bba3f

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Vulnerable Driver Load By Name
id: 72cd00d6-490c-4650-86ff-1d11f491daa1
status: test
description: Detects the load of known vulnerable drivers via the file name of the drivers.
references:
    - https://loldrivers.io/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-10-03
modified: 2023-12-02
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.t1543.003
    - attack.t1068
logsource:
    product: windows
    category: driver_load
detection:
    selection:
        ImageLoaded|endswith:
            - '\panmonfltx64.sys'
            - '\dbutil.sys'
            - '\fairplaykd.sys'
            - '\nvaudio.sys'
            - '\superbmc.sys'
            - '\bsmi.sys'
            - '\smarteio64.sys'
            - '\bwrsh.sys'
            - '\agent64.sys'
            - '\asmmap64.sys'
            - '\dellbios.sys'
            - '\chaos-rootkit.sys'
            - '\wcpu.sys'
            - '\dh_kernel.sys'
            - '\sbiosio64.sys'
            - '\bw.sys'
            - '\asrdrv102.sys'
            - '\nt6.sys'
            - '\mhyprot3.sys'
            - '\winio64c.sys'
            - '\asupio64.sys'
            - '\blackbonedrv10.sys'
            - '\d.sys'
            - '\driver7-x86.sys'
            - '\sfdrvx32.sys'
            - '\enetechio64.sys'
            - '\gdrv.sys'
            - '\sysinfodetectorx64.sys'
            - '\fh-ethercat_dio.sys'
            - '\asromgdrv.sys'
            - '\my.sys'
            - '\dcprotect.sys'
            - '\irec.sys'
            - '\gedevdrv.sys'
            - '\winio32a.sys'
            - '\gvcidrv64.sys'
            - '\winio32.sys'
            - '\bs_hwmio64.sys'
            - '\nstr.sys'
            - '\inpoutx64.sys'
            - '\hw.sys'
            - '\winio64.sys'
            - '\hpportiox64.sys'
            - '\iobitunlocker.sys'
            - '\b1.sys'
            - '\aoddriver.sys'
            - '\elbycdio.sys'
            - '\protects.sys'
            - '\kprocesshacker.sys'
            - '\speedfan.sys'
            - '\radhwmgr.sys'
            - '\iscflashx64.sys'
            - '\black.sys'
            - '\b4.sys'
            - '\hwos2ec10x64.sys'
            - '\winflash64.sys'
            - '\corsairllaccess64.sys'
            - '\bs_i2cio.sys'
            - '\d3.sys'
            - '\windows-xp-64.sys'
            - '\aswvmm.sys'
            - '\bs_i2c64.sys'
            - '\1.sys'
            - '\nchgbios2x64.sys'
            - '\cpuz141.sys'
            - '\segwindrvx64.sys'
            - '\tdeio64.sys'
            - '\ntiolib.sys'
            - '\gtckmdfbs.sys'
            - '\iomap64.sys'
            - '\avalueio.sys'
            - '\semav6msr.sys'
            - '\lgdcatcher.sys'
            - '\b.sys'
            - '\hwdetectng.sys'
            - '\nt4.sys'
            - '\tgsafe.sys'
            - '\mydrivers.sys'
            - '\eneio64.sys'
            - '\procexp.sys'
            - '\viragt64.sys'
            - '\fpcie2com.sys'
            - '\lenovodiagnosticsdriver.sys'
            - '\cp2x72c.sys'
            - '\kerneld.amd64'
            - '\bs_def64.sys'
            - '\piddrv.sys'
            - '\amifldrv64.sys'
            - '\cpuz_x64.sys'
            - '\proxy32.sys'
            - '\wsdkd.sys'
            - '\t8.sys'
            - '\ucorew64.sys'
            - '\atszio.sys'
            - '\lmiinfo.sys'
            - '\80.sys'
            - '\nt3.sys'
            - '\ngiodriver.sys'
            - '\lv561av.sys'
            - '\gpcidrv64.sys'
            - '\fd3b7234419fafc9bdd533f48896ed73_b816c5cd.sys'
            - '\rtport.sys'
            - '\full.sys'
            - '\viragt.sys'
            - '\fiddrv64.sys'
            - '\cupfixerx64.sys'
            - '\cpupress.sys'
            - '\hwos2ec7x64.sys'
            - '\driver7-x86-withoutdbg.sys'
            - '\asrdrv10.sys'
            - '\nvflsh64.sys'
            - '\asrrapidstartdrv.sys'
            - '\tmcomm.sys'
            - '\wiseunlo.sys'
            - '\rwdrv.sys'
            - '\asio64.sys'
            - '\nvoclock.sys'
            - '\panio.sys'
            - '\mtcbsv64.sys'
            - '\amigendrv64.sys'
            - '\capcom.sys'
            - '\netflt.sys'
            - '\phlashnt.sys'
            - '\dbutil_2_3.sys'
            - '\ni.sys'
            - '\ntiolib_x64.sys'
            - '\atszio64.sys'
            - '\lgcoretemp.sys'
            - '\lha.sys'
            - '\phymem64.sys'
            - '\dbutildrv2.sys'
            - '\asrdrv103.sys'
            - '\rtcore64.sys'
            - '\bs_hwmio64_w10.sys'
            - '\ene.sys'
            - '\winio64b.sys'
            - '\piddrv64.sys'
            - '\directio32.sys'
            - '\monitor_win10_x64.sys'
            - '\nt5.sys'
            - '\asrsmartconnectdrv.sys'
            - '\rtif.sys'
            - '\atillk64.sys'
            - '\directio.sys'
            - '\asribdrv.sys'
            - '\kfeco11x64.sys'
            - '\citmdrv_ia64.sys'
            - '\sysdrv3s.sys'
            - '\amp.sys'
            - '\vboxdrv.sys'
            - '\adv64drv.sys'
            - '\hostnt.sys'
            - '\phymem_ext64.sys'
            - '\echo_driver.sys'
            - '\winiodrv.sys'
            - '\pdfwkrnl.sys'
            - '\glckio2.sys'
            - '\asrdrv106.sys'
            - '\nscm.sys'
            - '\bs_rcio64.sys'
            - '\ncpl.sys'
            - '\sandra.sys'
            - '\fiddrv.sys'
            - '\hwrwdrv.sys'
            - '\mhyprot.sys'
            - '\asrsetupdrv103.sys'
            - '\iqvw64.sys'
            - '\b3.sys'
            - '\ssport.sys'
            - '\bs_def.sys'
            - '\computerz.sys'
            - '\windows8-10-32.sys'
            - '\nstrwsk.sys'
            - '\lurker.sys'
            - '\bsmemx64.sys'
            - '\wyproxy64.sys'
            - '\asio.sys'
            - '\t3.sys'
            - '\cpuz.sys'
            - '\rtkio.sys'
            - '\driver7-x64.sys'
            - '\netfilterdrv.sys'
            - '\ioaccess.sys'
            - '\testbone.sys'
            - '\gameink.sys'
            - '\kevp64.sys'
            - '\mhyprot2.sys'
            - '\se64a.sys'
            - '\vboxusb.sys'
            - '\windows7-32.sys'
            - '\vproeventmonitor.sys'
            - '\winio64a.sys'
            - '\asrdrv101.sys'
            - '\netproxydriver.sys'
            - '\elrawdsk.sys'
            - '\zam64.sys'
            - '\cg6kwin2k.sys'
            - '\asupio.sys'
            - '\stdcdrvws64.sys'
            - '\81.sys'
            - '\citmdrv_amd64.sys'
            - '\amdryzenmasterdriver.sys'
            - '\vmdrv.sys'
            - '\sysinfo.sys'
            - '\alsysio64.sys'
            - '\directio64.sys'
            - '\rzpnk.sys'
            - '\amdpowerprofiler.sys'
            - '\truesight.sys'
            - '\wirwadrv.sys'
            - '\phymemx64.sys'
            - '\msio64.sys'
            - '\sepdrv3_1.sys'
            - '\gametersafe.sys'
            - '\bs_rcio.sys'
            - '\d4.sys'
            - '\t.sys'
            - '\eio.sys'
            - '\nt2.sys'
            - '\winring0.sys'
            - '\physmem.sys'
            - '\libnicm.sys'
            - '\msio32.sys'
            - '\asrautochkupddrv.sys'
            - '\asio32.sys'
            - '\etdsupp.sys'
            - '\smep_namco.sys'
            - '\bandai.sys'
            - '\d2.sys'
            - '\magdrvamd64.sys'
            - '\nvflash.sys'
            - '\goad.sys'
            - '\proxy64.sys'
            - '\amsdk.sys'
            - '\kbdcap64.sys'
            - '\vdbsv64.sys'
            - '\pchunter.sys'
            - '\sysconp.sys'
            - '\dh_kernel_10.sys'
            - '\msrhook.sys'
            - '\bedaisy.sys'
            - '\dcr.sys'
            - '\panmonflt.sys'
            - '\bsmixp64.sys'
            - '\otipcibus.sys'
            - '\fidpcidrv.sys'
            - '\kfeco10x64.sys'
            - '\asrdrv104.sys'
            - '\c.sys'
            - '\tdklib64.sys'
            - '\bsmix64.sys'
            - '\bs_flash64.sys'
            - '\stdcdrv64.sys'
            - '\naldrv.sys'
            - '\ctiio64.sys'
            - '\bwrs.sys'
            - '\nicm.sys'
            - '\winio32b.sys'
            - '\paniox64.sys'
            - '\ecsiodriverx64.sys'
            - '\iomem64.sys'
            - '\fidpcidrv64.sys'
            - '\aswarpot.sys'
            - '\bs_rciow1064.sys'
            - '\asmio64.sys'
            - '\openlibsys.sys'
            - '\viraglt64.sys'
            - '\dbk64.sys'
            - '\t7.sys'
            - '\atlaccess.sys'
            - '\nbiolib_x64.sys'
            - '\smep_capcom.sys'
            - '\iqvw64e.sys'
    condition: selection
falsepositives:
    - False positives may occur if one of the vulnerable driver names mentioned above didn't change its name between versions. So always make sure that the driver being loaded is the legitimate one and the non vulnerable version.
    - If you experience a lot of FP you could comment the driver name or its exact known legitimate location (when possible)
level: low

Original YAML and metadata in JSON

False positives

• False positives may occur if one of the vulnerable driver names mentioned above didn't change its name between versions. So always make sure that the driver being loaded is the legitimate one and the non vulnerable version.
• If you experience a lot of FP you could comment the driver name or its exact known legitimate location (when possible)

Source references

• https://loldrivers.io/