title: Vulnerable Driver Load By Name id: 72cd00d6-490c-4650-86ff-1d11f491daa1 status: test description: Detects the load of known vulnerable drivers via the file name of the drivers. references: - https://loldrivers.io/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-03 modified: 2023-12-02 tags: - attack.persistence - attack.privilege-escalation - attack.t1543.003 - attack.t1068 logsource: product: windows category: driver_load detection: selection: ImageLoaded|endswith: - '\panmonfltx64.sys' - '\dbutil.sys' - '\fairplaykd.sys' - '\nvaudio.sys' - '\superbmc.sys' - '\bsmi.sys' - '\smarteio64.sys' - '\bwrsh.sys' - '\agent64.sys' - '\asmmap64.sys' - '\dellbios.sys' - '\chaos-rootkit.sys' - '\wcpu.sys' - '\dh_kernel.sys' - '\sbiosio64.sys' - '\bw.sys' - '\asrdrv102.sys' - '\nt6.sys' - '\mhyprot3.sys' - '\winio64c.sys' - '\asupio64.sys' - '\blackbonedrv10.sys' - '\d.sys' - '\driver7-x86.sys' - '\sfdrvx32.sys' - '\enetechio64.sys' - '\gdrv.sys' - '\sysinfodetectorx64.sys' - '\fh-ethercat_dio.sys' - '\asromgdrv.sys' - '\my.sys' - '\dcprotect.sys' - '\irec.sys' - '\gedevdrv.sys' - '\winio32a.sys' - '\gvcidrv64.sys' - '\winio32.sys' - '\bs_hwmio64.sys' - '\nstr.sys' - '\inpoutx64.sys' - '\hw.sys' - '\winio64.sys' - '\hpportiox64.sys' - '\iobitunlocker.sys' - '\b1.sys' - '\aoddriver.sys' - '\elbycdio.sys' - '\protects.sys' - '\kprocesshacker.sys' - '\speedfan.sys' - '\radhwmgr.sys' - '\iscflashx64.sys' - '\black.sys' - '\b4.sys' - '\hwos2ec10x64.sys' - '\winflash64.sys' - '\corsairllaccess64.sys' - '\bs_i2cio.sys' - '\d3.sys' - '\windows-xp-64.sys' - '\aswvmm.sys' - '\bs_i2c64.sys' - '\1.sys' - '\nchgbios2x64.sys' - '\cpuz141.sys' - '\segwindrvx64.sys' - '\tdeio64.sys' - '\ntiolib.sys' - '\gtckmdfbs.sys' - '\iomap64.sys' - '\avalueio.sys' - '\semav6msr.sys' - '\lgdcatcher.sys' - '\b.sys' - '\hwdetectng.sys' - '\nt4.sys' - '\tgsafe.sys' - '\mydrivers.sys' - '\eneio64.sys' - '\procexp.sys' - '\viragt64.sys' - '\fpcie2com.sys' - '\lenovodiagnosticsdriver.sys' - '\cp2x72c.sys' - '\kerneld.amd64' - '\bs_def64.sys' - '\piddrv.sys' - '\amifldrv64.sys' - '\cpuz_x64.sys' - '\proxy32.sys' - '\wsdkd.sys' - '\t8.sys' - '\ucorew64.sys' - '\atszio.sys' - '\lmiinfo.sys' - '\80.sys' - '\nt3.sys' - '\ngiodriver.sys' - '\lv561av.sys' - '\gpcidrv64.sys' - '\fd3b7234419fafc9bdd533f48896ed73_b816c5cd.sys' - '\rtport.sys' - '\full.sys' - '\viragt.sys' - '\fiddrv64.sys' - '\cupfixerx64.sys' - '\cpupress.sys' - '\hwos2ec7x64.sys' - '\driver7-x86-withoutdbg.sys' - '\asrdrv10.sys' - '\nvflsh64.sys' - '\asrrapidstartdrv.sys' - '\tmcomm.sys' - '\wiseunlo.sys' - '\rwdrv.sys' - '\asio64.sys' - '\nvoclock.sys' - '\panio.sys' - '\mtcbsv64.sys' - '\amigendrv64.sys' - '\capcom.sys' - '\netflt.sys' - '\phlashnt.sys' - '\dbutil_2_3.sys' - '\ni.sys' - '\ntiolib_x64.sys' - '\atszio64.sys' - '\lgcoretemp.sys' - '\lha.sys' - '\phymem64.sys' - '\dbutildrv2.sys' - '\asrdrv103.sys' - '\rtcore64.sys' - '\bs_hwmio64_w10.sys' - '\ene.sys' - '\winio64b.sys' - '\piddrv64.sys' - '\directio32.sys' - '\monitor_win10_x64.sys' - '\nt5.sys' - '\asrsmartconnectdrv.sys' - '\rtif.sys' - '\atillk64.sys' - '\directio.sys' - '\asribdrv.sys' - '\kfeco11x64.sys' - '\citmdrv_ia64.sys' - '\sysdrv3s.sys' - '\amp.sys' - '\vboxdrv.sys' - '\adv64drv.sys' - '\hostnt.sys' - '\phymem_ext64.sys' - '\echo_driver.sys' - '\winiodrv.sys' - '\pdfwkrnl.sys' - '\glckio2.sys' - '\asrdrv106.sys' - '\nscm.sys' - '\bs_rcio64.sys' - '\ncpl.sys' - '\sandra.sys' - '\fiddrv.sys' - '\hwrwdrv.sys' - '\mhyprot.sys' - '\asrsetupdrv103.sys' - '\iqvw64.sys' - '\b3.sys' - '\ssport.sys' - '\bs_def.sys' - '\computerz.sys' - '\windows8-10-32.sys' - '\nstrwsk.sys' - '\lurker.sys' - '\bsmemx64.sys' - '\wyproxy64.sys' - '\asio.sys' - '\t3.sys' - '\cpuz.sys' - '\rtkio.sys' - '\driver7-x64.sys' - '\netfilterdrv.sys' - '\ioaccess.sys' - '\testbone.sys' - '\gameink.sys' - '\kevp64.sys' - '\mhyprot2.sys' - '\se64a.sys' - '\vboxusb.sys' - '\windows7-32.sys' - '\vproeventmonitor.sys' - '\winio64a.sys' - '\asrdrv101.sys' - '\netproxydriver.sys' - '\elrawdsk.sys' - '\zam64.sys' - '\cg6kwin2k.sys' - '\asupio.sys' - '\stdcdrvws64.sys' - '\81.sys' - '\citmdrv_amd64.sys' - '\amdryzenmasterdriver.sys' - '\vmdrv.sys' - '\sysinfo.sys' - '\alsysio64.sys' - '\directio64.sys' - '\rzpnk.sys' - '\amdpowerprofiler.sys' - '\truesight.sys' - '\wirwadrv.sys' - '\phymemx64.sys' - '\msio64.sys' - '\sepdrv3_1.sys' - '\gametersafe.sys' - '\bs_rcio.sys' - '\d4.sys' - '\t.sys' - '\eio.sys' - '\nt2.sys' - '\winring0.sys' - '\physmem.sys' - '\libnicm.sys' - '\msio32.sys' - '\asrautochkupddrv.sys' - '\asio32.sys' - '\etdsupp.sys' - '\smep_namco.sys' - '\bandai.sys' - '\d2.sys' - '\magdrvamd64.sys' - '\nvflash.sys' - '\goad.sys' - '\proxy64.sys' - '\amsdk.sys' - '\kbdcap64.sys' - '\vdbsv64.sys' - '\pchunter.sys' - '\sysconp.sys' - '\dh_kernel_10.sys' - '\msrhook.sys' - '\bedaisy.sys' - '\dcr.sys' - '\panmonflt.sys' - '\bsmixp64.sys' - '\otipcibus.sys' - '\fidpcidrv.sys' - '\kfeco10x64.sys' - '\asrdrv104.sys' - '\c.sys' - '\tdklib64.sys' - '\bsmix64.sys' - '\bs_flash64.sys' - '\stdcdrv64.sys' - '\naldrv.sys' - '\ctiio64.sys' - '\bwrs.sys' - '\nicm.sys' - '\winio32b.sys' - '\paniox64.sys' - '\ecsiodriverx64.sys' - '\iomem64.sys' - '\fidpcidrv64.sys' - '\aswarpot.sys' - '\bs_rciow1064.sys' - '\asmio64.sys' - '\openlibsys.sys' - '\viraglt64.sys' - '\dbk64.sys' - '\t7.sys' - '\atlaccess.sys' - '\nbiolib_x64.sys' - '\smep_capcom.sys' - '\iqvw64e.sys' condition: selection falsepositives: - False positives may occur if one of the vulnerable driver names mentioned above didn't change its name between versions. So always make sure that the driver being loaded is the legitimate one and the non vulnerable version. - If you experience a lot of FP you could comment the driver name or its exact known legitimate location (when possible) level: low