Name:Windows Vulnerable Driver Loaded id:a2b1f1ef-221f-4187-b2a4-d4b08ec745f4 version:9 date:2026-03-16 author:Michael Haag, Splunk status:production type:Hunting Description:The following analytic detects the loading of known vulnerable Windows drivers, which may indicate potential persistence or privilege escalation attempts. It leverages Sysmon EventCode 6 to identify driver loading events and cross-references them with a list of vulnerable drivers. This activity is significant as attackers often exploit vulnerable drivers to gain elevated privileges or maintain persistence on a system. If confirmed malicious, this could allow attackers to execute arbitrary code with high privileges, leading to further system compromise and potential data exfiltration. Data_source:
-Sysmon EventID 6
search:`sysmon` EventCode=6
| stats min(_time) as firstTime max(_time) as lastTime count BY ImageLoaded dest dvc process_hash process_path signature signature_id user_id vendor_product
| lookup loldrivers driver_name AS ImageLoaded OUTPUT is_driver driver_description
