Detection rules › Sigma

Vulnerable HackSys Extreme Vulnerable Driver Load

Status
test
Severity
high
Log source
product windows, category driver_load
Author
Nasreddine Bencherchali (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects the load of HackSys Extreme Vulnerable Driver which is an intentionally vulnerable Windows driver developed for security enthusiasts to learn and polish their exploitation skills at Kernel level and often abused by threat actors

MITRE ATT&CK coverage

Event coverage

ProviderEventTitle
SysmonEvent ID 6Driver loaded

Rule body yaml

title: Vulnerable HackSys Extreme Vulnerable Driver Load
id: 295c9289-acee-4503-a571-8eacaef36b28
status: test
description: Detects the load of HackSys Extreme Vulnerable Driver which is an intentionally vulnerable Windows driver developed for security enthusiasts to learn and polish their exploitation skills at Kernel level and often abused by threat actors
references:
    - https://github.com/hacksysteam/HackSysExtremeVulnerableDriver
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-08-18
modified: 2024-11-23
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.t1543.003
logsource:
    product: windows
    category: driver_load
detection:
    selection:
        - ImageLoaded|endswith: '\HEVD.sys'
        - Hashes|contains:
              - 'IMPHASH=f26d0b110873a1c7d8c4f08fbeab89c5' # Version 3.0
              - 'IMPHASH=c46ea2e651fd5f7f716c8867c6d13594' # Version 3.0
    condition: selection
falsepositives:
    - Unlikely
level: high

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
    - ImageLoaded|endswith: '\HEVD.sys'
    - Hashes|contains:
          - 'IMPHASH=f26d0b110873a1c7d8c4f08fbeab89c5'
          - 'IMPHASH=c46ea2e651fd5f7f716c8867c6d13594'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Hashesmatch
  • IMPHASH=c46ea2e651fd5f7f716c8867c6d13594
  • IMPHASH=f26d0b110873a1c7d8c4f08fbeab89c5
ImageLoadedends_with
  • \HEVD.sys