EXPLORE
Sign In
← Back to Explore
sigmahighHunting

WinDivert Driver Load

Detects the load of the Windiver driver, a powerful user-mode capture/sniffing/modification/blocking/re-injection package for Windows

MITRE ATT&CK

T1599.001T1557.001
credential-accesscollectiondefense-evasion

Detection Query

selection:
  - ImageLoaded|contains:
      - \WinDivert.sys
      - \WinDivert64.sys
      - \NordDivert.sys
      - \lingtiwfp.sys
      - \eswfp.sys
  - Hashes|contains:
      - IMPHASH=0604bb7cb4bb851e2168d5c7d9399087
      - IMPHASH=2e5f0e649d97f32b03c09e4686d0574f
      - IMPHASH=52f8aa269f69f0edad9e8fcdaedce276
      - IMPHASH=c0e5d314da39dbf65a2dbff409cc2c76
      - IMPHASH=58623490691babe8330adc81cd04a663
      - IMPHASH=8ee39b48656e4d6b8459d7ba7da7438b
      - IMPHASH=45ee545ae77e8d43fc70ede9efcd4c96
      - IMPHASH=a1b2e245acd47e4a348e1a552a02859a
      - IMPHASH=2a5f85fe4609461c6339637594fa9b0a
      - IMPHASH=6b2c6f95233c2914d1d488ee27531acc
      - IMPHASH=9f2fdd3f9ab922bbb0560a7df46f4342
      - IMPHASH=d8a719865c448b1bd2ec241e46ac1c88
      - IMPHASH=0ea54f8c9af4a2fe8367fa457f48ed38
      - IMPHASH=9d519ae0a0864d6d6ae3f8b6c9c70af6
      - IMPHASH=a74929edfc3289895e3f2885278947ae
      - IMPHASH=a66b476c2d06c370f0a53b5537f2f11e
      - IMPHASH=bdcd836a46bc2415773f6b5ea77a46e4
      - IMPHASH=c28cd6ccd83179e79dac132a553693d9
condition: selection

Author

Florian Roth (Nextron Systems)

Created

2021-07-30

Data Sources

windowsDriver Load Events

Platforms

windows

References

Tags

attack.credential-accessattack.collectionattack.defense-evasionattack.t1599.001attack.t1557.001
Raw Content
title: WinDivert Driver Load
id: 679085d5-f427-4484-9f58-1dc30a7c426d
status: test
description: Detects the load of the Windiver driver, a powerful user-mode capture/sniffing/modification/blocking/re-injection package for Windows
references:
    - https://reqrypt.org/windivert-doc.html
    - https://rastamouse.me/ntlm-relaying-via-cobalt-strike/
author: Florian Roth (Nextron Systems)
date: 2021-07-30
modified: 2024-11-23
tags:
    - attack.credential-access
    - attack.collection
    - attack.defense-evasion
    - attack.t1599.001
    - attack.t1557.001
logsource:
    category: driver_load
    product: windows
detection:
    selection:
        - ImageLoaded|contains:
              - '\WinDivert.sys'
              - '\WinDivert64.sys'
              # Other used names
              - '\NordDivert.sys'
              - '\lingtiwfp.sys'
              - '\eswfp.sys'
        - Hashes|contains:
              - 'IMPHASH=0604bb7cb4bb851e2168d5c7d9399087'
              - 'IMPHASH=2e5f0e649d97f32b03c09e4686d0574f'
              - 'IMPHASH=52f8aa269f69f0edad9e8fcdaedce276'
              - 'IMPHASH=c0e5d314da39dbf65a2dbff409cc2c76'
              - 'IMPHASH=58623490691babe8330adc81cd04a663'
              - 'IMPHASH=8ee39b48656e4d6b8459d7ba7da7438b'
              - 'IMPHASH=45ee545ae77e8d43fc70ede9efcd4c96'
              - 'IMPHASH=a1b2e245acd47e4a348e1a552a02859a'
              - 'IMPHASH=2a5f85fe4609461c6339637594fa9b0a'
              - 'IMPHASH=6b2c6f95233c2914d1d488ee27531acc'
              - 'IMPHASH=9f2fdd3f9ab922bbb0560a7df46f4342'
              - 'IMPHASH=d8a719865c448b1bd2ec241e46ac1c88'
              - 'IMPHASH=0ea54f8c9af4a2fe8367fa457f48ed38'
              - 'IMPHASH=9d519ae0a0864d6d6ae3f8b6c9c70af6'
              - 'IMPHASH=a74929edfc3289895e3f2885278947ae'
              - 'IMPHASH=a66b476c2d06c370f0a53b5537f2f11e'
              - 'IMPHASH=bdcd836a46bc2415773f6b5ea77a46e4'
              - 'IMPHASH=c28cd6ccd83179e79dac132a553693d9'
    condition: selection
falsepositives:
    - Legitimate WinDivert driver usage
level: high