Detectionhightest

WinDivert Driver Load

Detects the load of the Windiver driver, a powerful user-mode capture/sniffing/modification/blocking/re-injection package for Windows

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Florian Roth (Nextron Systems)Created Fri Jul 30Updated Sat Nov 23679085d5-f427-4484-9f58-1dc30a7c426dwindows

Log Source

WindowsDriver Load

ProductWindows← raw: windows

CategoryDriver Load← raw: driver_load

Detection Logic

detection:
    selection:
        - ImageLoaded|contains:
              - '\WinDivert.sys'
              - '\WinDivert64.sys'
              # Other used names
              - '\NordDivert.sys'
              - '\lingtiwfp.sys'
              - '\eswfp.sys'
        - Hashes|contains:
              - 'IMPHASH=0604bb7cb4bb851e2168d5c7d9399087'
              - 'IMPHASH=2e5f0e649d97f32b03c09e4686d0574f'
              - 'IMPHASH=52f8aa269f69f0edad9e8fcdaedce276'
              - 'IMPHASH=c0e5d314da39dbf65a2dbff409cc2c76'
              - 'IMPHASH=58623490691babe8330adc81cd04a663'
              - 'IMPHASH=8ee39b48656e4d6b8459d7ba7da7438b'
              - 'IMPHASH=45ee545ae77e8d43fc70ede9efcd4c96'
              - 'IMPHASH=a1b2e245acd47e4a348e1a552a02859a'
              - 'IMPHASH=2a5f85fe4609461c6339637594fa9b0a'
              - 'IMPHASH=6b2c6f95233c2914d1d488ee27531acc'
              - 'IMPHASH=9f2fdd3f9ab922bbb0560a7df46f4342'
              - 'IMPHASH=d8a719865c448b1bd2ec241e46ac1c88'
              - 'IMPHASH=0ea54f8c9af4a2fe8367fa457f48ed38'
              - 'IMPHASH=9d519ae0a0864d6d6ae3f8b6c9c70af6'
              - 'IMPHASH=a74929edfc3289895e3f2885278947ae'
              - 'IMPHASH=a66b476c2d06c370f0a53b5537f2f11e'
              - 'IMPHASH=bdcd836a46bc2415773f6b5ea77a46e4'
              - 'IMPHASH=c28cd6ccd83179e79dac132a553693d9'
    condition: selection