Vulnerable HackSys Extreme Vulnerable Driver Load

Status: test
Severity: high
Log source: category driver_load, product windows
Author: Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects the load of HackSys Extreme Vulnerable Driver which is an intentionally vulnerable Windows driver developed for security enthusiasts to learn and polish their exploitation skills at Kernel level and often abused by threat actors

Known false positives

Unlikely

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1543.003` Create or Modify System Process: Windows Service
Privilege Escalation	`T1543.003` Create or Modify System Process: Windows Service

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 6: Driver loaded

Rule body

title: Vulnerable HackSys Extreme Vulnerable Driver Load
id: 295c9289-acee-4503-a571-8eacaef36b28
status: test
description: Detects the load of HackSys Extreme Vulnerable Driver which is an intentionally vulnerable Windows driver developed for security enthusiasts to learn and polish their exploitation skills at Kernel level and often abused by threat actors
references:
    - https://github.com/hacksysteam/HackSysExtremeVulnerableDriver
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-08-18
modified: 2024-11-23
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.t1543.003
logsource:
    product: windows
    category: driver_load
detection:
    selection:
        - ImageLoaded|endswith: '\HEVD.sys'
        - Hashes|contains:
              - 'IMPHASH=f26d0b110873a1c7d8c4f08fbeab89c5' # Version 3.0
              - 'IMPHASH=c46ea2e651fd5f7f716c8867c6d13594' # Version 3.0
    condition: selection
falsepositives:
    - Unlikely
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    - ImageLoaded|endswith: '\HEVD.sys'
    - Hashes|contains:
          - 'IMPHASH=f26d0b110873a1c7d8c4f08fbeab89c5'
          - 'IMPHASH=c46ea2e651fd5f7f716c8867c6d13594'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Hashes`	match	`IMPHASH=c46ea2e651fd5f7f716c8867c6d13594` `IMPHASH=f26d0b110873a1c7d8c4f08fbeab89c5`	`field:"Hashes" kind:match`
`ImageLoaded`	ends_with	`\HEVD.sys`	`field:"ImageLoaded" kind:ends_with value:"\HEVD.sys"`