Detection rules › Sigma
PUA - Kernel Driver Utility (KDU) Execution
Detects execution of the Kernel Driver Utility (KDU) tool. KDU can be used to bypass driver signature enforcement and load unsigned or malicious drivers into the Windows kernel. Potentially allowing for privilege escalation, persistence, or evasion of security controls.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence | T1543.003 Create or Modify System Process: Windows Service |
| Privilege Escalation | T1543.003 Create or Modify System Process: Windows Service |
Event coverage
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 1 | Process creation |
Rule body yaml
title: PUA - Kernel Driver Utility (KDU) Execution
id: e76ca062-4de0-4d79-8d90-160a0d335eca
status: experimental
description: |
Detects execution of the Kernel Driver Utility (KDU) tool.
KDU can be used to bypass driver signature enforcement and load unsigned or malicious drivers into the Windows kernel.
Potentially allowing for privilege escalation, persistence, or evasion of security controls.
references:
- https://github.com/h4rmy/KDU
- https://huntress.com/blog/esxi-vm-escape-exploit
author: Matt Anderson, Dray Agha, Anna Pham (Huntress)
date: 2026-01-02
tags:
- attack.persistence
- attack.privilege-escalation
- attack.t1543.003
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith:
- '\kdu.exe'
- '\hamakaze.exe'
- OriginalFileName: 'hamakaze.exe'
selection_cli_suspicious:
CommandLine|contains:
- '-map ' # map driver to the kernel and execute it entry point
- '-prv ' # optional, select vulnerability driver provider
- '-dse ' # write user defined value to the system DSE state flags; dse=0(disable),dse=1(enable)
- '-ps ' # modify process object of given ProcessID;
condition: all of selection_*
falsepositives:
- Legitimate driver development, testing, or administrative troubleshooting (e.g., enabling/disabling hardware)
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_pua_kdu_driver_tool/info.yml
Stages and Predicates
Stage 0: condition
all of selection_*Stage 1: selection_img
selection_img:
- Image|endswith:
- '\kdu.exe'
- '\hamakaze.exe'
- OriginalFileName: 'hamakaze.exe'
Stage 2: selection_cli_suspicious
selection_cli_suspicious:
CommandLine|contains:
- '-map '
- '-prv '
- '-dse '
- '-ps '
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
CommandLine | match |
|
Image | ends_with |
|
OriginalFileName | eq |
|