WinDivert Driver Load

Severity: high
Author: Florian Roth (Nextron Systems)
Source: upstream

Detects the load of the Windiver driver, a powerful user-mode capture/sniffing/modification/blocking/re-injection package for Windows

MITRE ATT&CK coverage

Tactic	Techniques
Defense Evasion	`T1599.001` Network Boundary Bridging: Network Address Translation Traversal
Credential Access	`T1557.001` Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay
Collection	`T1557.001` Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay

Event coverage

Provider	Event ID	Title
Sysmon	6	Driver loaded

Stages and Predicates

Stage 1: `selection`

or:
Hashes|contains: 'IMPHASH=0604bb7cb4bb851e2168d5c7d9399087'
Hashes|contains: 'IMPHASH=0ea54f8c9af4a2fe8367fa457f48ed38'
Hashes|contains: 'IMPHASH=2a5f85fe4609461c6339637594fa9b0a'
Hashes|contains: 'IMPHASH=2e5f0e649d97f32b03c09e4686d0574f'
Hashes|contains: 'IMPHASH=45ee545ae77e8d43fc70ede9efcd4c96'
Hashes|contains: 'IMPHASH=52f8aa269f69f0edad9e8fcdaedce276'
Hashes|contains: 'IMPHASH=58623490691babe8330adc81cd04a663'
Hashes|contains: 'IMPHASH=6b2c6f95233c2914d1d488ee27531acc'
Hashes|contains: 'IMPHASH=8ee39b48656e4d6b8459d7ba7da7438b'
Hashes|contains: 'IMPHASH=9d519ae0a0864d6d6ae3f8b6c9c70af6'
Hashes|contains: 'IMPHASH=9f2fdd3f9ab922bbb0560a7df46f4342'
Hashes|contains: 'IMPHASH=a1b2e245acd47e4a348e1a552a02859a'
Hashes|contains: 'IMPHASH=a66b476c2d06c370f0a53b5537f2f11e'
Hashes|contains: 'IMPHASH=a74929edfc3289895e3f2885278947ae'
Hashes|contains: 'IMPHASH=bdcd836a46bc2415773f6b5ea77a46e4'
Hashes|contains: 'IMPHASH=c0e5d314da39dbf65a2dbff409cc2c76'
Hashes|contains: 'IMPHASH=c28cd6ccd83179e79dac132a553693d9'
Hashes|contains: 'IMPHASH=d8a719865c448b1bd2ec241e46ac1c88'
ImageLoaded|contains: '\NordDivert.sys'
ImageLoaded|contains: '\WinDivert.sys'
ImageLoaded|contains: '\WinDivert64.sys'
ImageLoaded|contains: '\eswfp.sys'
ImageLoaded|contains: '\lingtiwfp.sys'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.