Sigma rule: WinDivert Driver Load

A detection rule from the SigmaHQ repository, shown as its author published it. Dataset version ref-673da9ae29a2, updated 2024-11-23T00:00:00.000Z.

Rule

Title
WinDivert Driver Load
Status
test
Level
high
Author
Florian Roth (Nextron Systems)
Date
2021-07-30
Modified
2024-11-23
File
rules/windows/driver_load/driver_load_win_windivert.yml
Commit
ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the load of the Windiver driver, a powerful user-mode capture/sniffing/modification/blocking/re-injection package for Windows

Log source

product
windows
category
driver_load

Detection

selection:
    - ImageLoaded|contains:
          - '\WinDivert.sys'
          - '\WinDivert64.sys'
          # Other used names
          - '\NordDivert.sys'
          - '\lingtiwfp.sys'
          - '\eswfp.sys'
    - Hashes|contains:
          - 'IMPHASH=0604bb7cb4bb851e2168d5c7d9399087'
          - 'IMPHASH=2e5f0e649d97f32b03c09e4686d0574f'
          - 'IMPHASH=52f8aa269f69f0edad9e8fcdaedce276'
          - 'IMPHASH=c0e5d314da39dbf65a2dbff409cc2c76'
          - 'IMPHASH=58623490691babe8330adc81cd04a663'
          - 'IMPHASH=8ee39b48656e4d6b8459d7ba7da7438b'
          - 'IMPHASH=45ee545ae77e8d43fc70ede9efcd4c96'
          - 'IMPHASH=a1b2e245acd47e4a348e1a552a02859a'
          - 'IMPHASH=2a5f85fe4609461c6339637594fa9b0a'
          - 'IMPHASH=6b2c6f95233c2914d1d488ee27531acc'
          - 'IMPHASH=9f2fdd3f9ab922bbb0560a7df46f4342'
          - 'IMPHASH=d8a719865c448b1bd2ec241e46ac1c88'
          - 'IMPHASH=0ea54f8c9af4a2fe8367fa457f48ed38'
          - 'IMPHASH=9d519ae0a0864d6d6ae3f8b6c9c70af6'
          - 'IMPHASH=a74929edfc3289895e3f2885278947ae'
          - 'IMPHASH=a66b476c2d06c370f0a53b5537f2f11e'
          - 'IMPHASH=bdcd836a46bc2415773f6b5ea77a46e4'
          - 'IMPHASH=c28cd6ccd83179e79dac132a553693d9'
condition: selection

False positives (as the rule lists them)

  • Legitimate WinDivert driver usage

Tags

  • attack.credential-access
  • attack.collection
  • attack.defense-impairment
  • attack.t1599.001
  • attack.t1557.001

MITRE ATT&CK ids this rule names

References

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/driver_load/driver_load_win_windivert.yml

Sources and licences

  • SigmaHQ

    "WinDivert Driver Load" by Florian Roth (Nextron Systems) (SigmaHQ). Rule: https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/driver_load/driver_load_win_windivert.yml.
    Licensed under the Detection Rule License (DRL) 1.1: https://github.com/SigmaHQ/Detection-Rule-License

    Detection Rule License (DRL) 1.1

Cite this page

Dragons Eye Ransomware Tracker, "Sigma rule: WinDivert Driver Load",
entity page, dataset version ref-673da9ae29a2, updated 2024-11-23T00:00:00.000Z,
https://ransomware-tracker.com/detections/sigma/679085d5-f427-4484-9f58-1dc30a7c426d (accessed 2026-11-03).
Underlying source: SigmaHQ rule 679085d5-f427-4484-9f58-1dc30a7c426d, commit ccbb0369507f796db0b0ae6854c8a2be471b9d84.

Pages change. The dataset version identifies the data, but no archive of old versions is kept, so this citation cannot be replayed later.