Sigma rule: Potential Privileged System Service Operation - SeLoadDriverPrivilege

Rule

Title

Potential Privileged System Service Operation - SeLoadDriverPrivilege

Status

test

Level

medium

Author

xknow (@xknow_infosec), xorxes (@xor_xes)

Date

2019-04-08

Modified

2026-06-29

File

rules/windows/builtin/security/win_security_user_driver_loaded.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the usage of the 'SeLoadDriverPrivilege' privilege. This privilege is required to load or unload a device driver.
With this privilege, the user can dynamically load and unload device drivers or other code in to kernel mode.
This user right does not apply to Plug and Play device drivers.
If you exclude privileged users/admins and processes, which are allowed to do so, you are maybe left with bad programs trying to load malicious kernel drivers.
This will detect Ghost-In-The-Logs (https://github.com/bats3c/Ghost-In-The-Logs) and the usage of Sysinternals and various other tools. So you have to work with a whitelist to find the bad stuff.

Log source

product

windows

service

security

Detection

selection_1:
    EventID: 4673
    PrivilegeList: 'SeLoadDriverPrivilege'
    Service: '-'
filter_main_exact:
    ProcessName:
        - 'C:\Windows\explorer.exe'
        - 'C:\Windows\HelpPane.exe'
        - 'C:\Windows\ImmersiveControlPanel\SystemSettings.exe'
        - 'C:\Windows\System32\Dism.exe'
        - 'C:\Windows\System32\fltMC.exe'
        - 'C:\Windows\System32\mmc.exe'
        - 'C:\Windows\System32\rundll32.exe'
        - 'C:\Windows\System32\RuntimeBroker.exe'
        - 'C:\Windows\System32\ShellHost.exe'
        - 'C:\Windows\System32\svchost.exe'
        - 'C:\Windows\System32\SystemSettingsBroker.exe'
        - 'C:\Windows\System32\wimserv.exe'
filter_optional_others:
    ProcessName|endswith:
        - '\AppData\Local\Microsoft\Teams\current\Teams.exe'
        - '\Google\Chrome\Application\chrome.exe'
        - '\procexp.exe'
        - '\procexp64.exe'
        - '\procexp64a.exe'
        - '\procmon.exe'
        - '\procmon64.exe'
        - '\procmon64a.exe'
filter_main_startswith:
    ProcessName|startswith: 'C:\Program Files\WindowsApps\Microsoft'
filter_optional_dropbox:
    ProcessName|startswith:
        - 'C:\Program Files (x86)\Dropbox\'
        - 'C:\Program Files\Dropbox\'
    ProcessName|endswith: '\Dropbox.exe'
condition: selection_1 and not 1 of filter_main_* and not 1 of filter_optional_*

False positives (as the rule lists them)

• Other legimate tools loading drivers. Including but not limited to, Sysinternals, CPU-Z, AVs etc. A baseline needs to be created according to the used products and allowed tools. A good thing to do is to try and exclude users who are allowed to load drivers.

Tags

• attack.defense-impairment
• attack.t1685

MITRE ATT&CK ids this rule names

• T1685

References

• https://web.archive.org/web/20230331181619/https://blog.dylan.codes/evading-sysmon-and-windows-event-logging/
• https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4673

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/builtin/security/win_security_user_driver_loaded.yml