Sigma rule: Vulnerable WinRing0 Driver Load

Rule

Title

Vulnerable WinRing0 Driver Load

Status

test

Level

high

Author

Florian Roth (Nextron Systems)

Date

2022-07-26

Modified

2024-11-23

File

rules/windows/driver_load/driver_load_win_vuln_winring0_driver.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the load of a signed WinRing0 driver often used by threat actors, crypto miners (XMRIG) or malware for privilege escalation

Log source

product

windows

category

driver_load

Detection

selection:
    - Hashes|contains: 'IMPHASH=D41FA95D4642DC981F10DE36F4DC8CD7'
    - ImageLoaded|endswith:
          - '\WinRing0x64.sys'
          - '\WinRing0.sys'
          - '\WinRing0.dll'
          - '\WinRing0x64.dll'
          - '\winring00x64.sys'
condition: selection

False positives (as the rule lists them)

• Unknown

Tags

• attack.persistence
• attack.privilege-escalation
• attack.t1543.003

MITRE ATT&CK ids this rule names

• T1543.003

References

• https://github.com/xmrig/xmrig/tree/master/bin/WinRing0
• https://www.rapid7.com/blog/post/2021/12/13/driver-based-attacks-past-and-present/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/driver_load/driver_load_win_vuln_winring0_driver.yml