Threat: Vulnerable Driver

Expired or Revoked Driver Loaded

Sep 19, 2026 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Privilege Escalation Tactic: Defense Evasion Data Source: Elastic Defend Resources: Investigation Guide Noise: Low Performance: Normal Profile: Recommended Threat: Vulnerable Driver Rule Type: Event Correlation (EQL) Platform: Windows ·

Share on:

Identifies an attempt to load a revoked or expired driver. Adversaries may bring outdated drivers with vulnerabilities to gain code execution in kernel mode or abuse revoked certificates to sign their drivers.

First Time Seen Driver Loaded

Sep 19, 2026 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Privilege Escalation Tactic: Persistence Resources: Investigation Guide Data Source: Elastic Defend Noise: Medium Performance: Normal Profile: Recommended Threat: Vulnerable Driver Rule Type: New Terms Platform: Windows Resources: Osquery ·

Share on:

Identifies the load of a driver with an original file name and signature values that were observed for the first time during the last 30 days. This rule type can help baseline drivers installation within your environment.

Kernel Driver Load by non-root User

Sep 19, 2026 · Data Source: Auditd Manager Domain: Endpoint OS: Linux Use Case: Threat Detection Tactic: Persistence Tactic: Defense Evasion Resources: Investigation Guide Noise: Low Performance: Normal Profile: Recommended Threat: Vulnerable Driver Rule Type: Event Correlation (EQL) Platform: Linux ·

Share on:

Detects the loading of a Linux kernel module by a non-root user through system calls. Threat actors may leverage Linux kernel modules to load a rootkit on a system providing them with complete control and the ability to hide from security products. As other rules monitor for the addition of Linux kernel modules through system utilities or .ko files, this rule covers the gap that evasive rootkits leverage by monitoring for kernel module additions on the lowest level through auditd_manager.

Untrusted Driver Loaded

Sep 19, 2026 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Defense Evasion Resources: Investigation Guide Data Source: Elastic Defend Noise: Low Performance: Normal Profile: Recommended Threat: Vulnerable Driver Rule Type: Event Correlation (EQL) Platform: Windows Resources: Osquery ·

Share on:

Identifies an untrusted driver loaded by the Windows kernel. Adversaries may modify code signing policies to enable execution of unsigned or self-signed kernel code.