Sunturai
Back to results
MediumSigmaHQNasreddine Bencherchali (Nextron Systems)

Malicious Driver Load By Name

Detects loading of known malicious drivers via the file name of the drivers.

Detection logic

Detection requirements

Platform
ContainersLinuxmacOSWindows

The rule states no platform. This is derived from the 2 ATT&CK techniques it maps to.

Log source product
windows
Log source category
driver_load

Known benign triggers

  • False positives may occur if one of the vulnerable driver names mentioned above didn't change its name between versions. So always make sure that the driver being loaded is the legitimate one and the non vulnerable version.
  • If you experience a lot of FP you could comment the driver name or its exact known legitimate location (when possible)

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice