Kernel driver service installed
A driver service was registered in the registry — an ImagePath written under CurrentControlSet\Services pointing at a .sys file.
What it detects
A driver service was registered in the registry — an ImagePath written under CurrentControlSet\Services pointing at a .sys file.
A kernel driver is the most privileged code on the machine. It runs below every endpoint-protection product, can hide processes and files from anything running in user mode, and can terminate protected processes that user-mode tooling cannot touch. That is why "bring your own vulnerable driver" is the standard route past a modern EDR: the attacker does not need to write kernel malware, only to load a SIGNED driver with a known flaw and drive it from user mode.
Pairs with windows.defense_evasion.kernel_integrity_weakened, which catches the boot-configuration change that lets an UNSIGNED driver load. This one catches the registration itself, signed or not.
MITRE ATT&CK mapping
False positives and triage
Legitimate driver installation is common — every hardware driver, VPN client, virtualization product and endpoint-security agent registers one, and Windows Update does it routinely. Expect real volume on workstations, and rather less on servers.
To confirm: read the .sys path in Details=. A driver under \Windows\System32\drivers\ installed by TiWorker.exe or a vendor installer is ordinary; one in \Temp\, \Users\ or \ProgramData\ is not. Check the driver's signature and reputation — in a BYOVD attack the driver is genuinely signed and genuinely legitimate, just old and exploitable, so "signed" is not reassurance here. Then look at what registered it: a driver installed by a script host or a binary that itself arrived recently is the finding.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 70%. Source: rules/windows/kernel_driver_service_installed.yaml, licensed under the Apache License 2.0.
id: windows.persistence.kernel_driver_service_installed
version: 1.0.0
status: stable
severity: high
confidence: 0.7
platforms: [windows]
mitre_techniques: [T1543.003, T1068, T1014]
description: |
A driver service was registered in the registry — an `ImagePath` written under
`CurrentControlSet\Services` pointing at a `.sys` file.
A kernel driver is the most privileged code on the machine. It runs below every
endpoint-protection product, can hide processes and files from anything running in
user mode, and can terminate protected processes that user-mode tooling cannot
touch. That is why "bring your own vulnerable driver" is the standard route past a
modern EDR: the attacker does not need to write kernel malware, only to load a
SIGNED driver with a known flaw and drive it from user mode.
Pairs with `windows.defense_evasion.kernel_integrity_weakened`, which catches the
boot-configuration change that lets an UNSIGNED driver load. This one catches the
registration itself, signed or not.
match:
registry_path_regex: '(?i)\\services\\[^\\]+\\(imagepath|start)$'
raw_message_contains_any: ['.sys']
correlation_keys: [hostname]
false_positive_guidance: |
Legitimate driver installation is common — every hardware driver, VPN client,
virtualization product and endpoint-security agent registers one, and Windows Update
does it routinely. Expect real volume on workstations, and rather less on servers.
To confirm: read the `.sys` path in `Details=`. A driver under
`\Windows\System32\drivers\` installed by `TiWorker.exe` or a vendor installer is
ordinary; one in `\Temp\`, `\Users\` or `\ProgramData\` is not. Check the driver's
signature and reputation — in a BYOVD attack the driver is genuinely signed and
genuinely legitimate, just old and exploitable, so "signed" is not reassurance here.
Then look at what registered it: a driver installed by a script host or a binary
that itself arrived recently is the finding.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.