Siemphony’s repertoire
Unsigned kernel driver loaded
AN1061's own `DriverSignatureStatus` knob — "signed vs unsigned drivers; many environments restrict unsigned drivers, but some legacy systems allow them" — maps onto a single real field on Sysmon EventID 6: `Signed`, a boolean set from the result of the load-time signature check. An adversary loading a custom rootkit driver is loading one that was never submitted for attestation signing, so `Signed: false` is the direct, single-field expression of the knob, deliberately narrower than the service-creation and file-drop legs of the same analytic (System 7045, Sysmon 11) which this rule does not attempt, since neither carries a signature verdict at all. This is the complement of the corpus's T1068 driver rule, which explicitly does not filter on signature because a bring-your-own-vulnerable-driver load is validly signed by definition — the two rules cover opposite ends of the same `DriverLoad` event and neither substitutes for the other. Sysmon is not installed by default, and on a fleet without it this rule returns nothing, which reads as quiet rather than as the blind spot it actually is. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0377, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full descriptionShow less
The detection
The 3 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.
detection.yml
title: Unsigned kernel driver loadedid: eab17826-1beb-4126-9184-c5d171c28220status: experimentaldescription: | AN1061's own `DriverSignatureStatus` knob — "signed vs unsigned drivers; many environments restrict unsigned drivers, but some legacy systems allow them" — maps onto a single real field on Sysmon EventID 6: `Signed`, a boolean set from the result of the load-time signature check. An adversary loading a custom rootkit driver is loading one that was never submitted for attestation signing, so `Signed: false` is the direct, single-field expression of the knob, deliberately narrower than the service-creation and file-drop legs of the same analytic (System 7045, Sysmon 11) which this rule does not attempt, since neither carries a signature verdict at all. This is the complement of the corpus's T1068 driver rule, which explicitly does not filter on signature because a bring-your-own-vulnerable-driver load is validly signed by definition — the two rules cover opposite ends of the same `DriverLoad` event and neither substitutes for the other. Sysmon is not installed by default, and on a fleet without it this rule returns nothing, which reads as quiet rather than as the blind spot it actually is. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0377, not hand-written and not tested by its author. Any lab result is on this rule's own page.references: - https://attack.mitre.org/techniques/T1014 - https://attack.mitre.org/detectionstrategies/DET0377author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)date: 2026-08-16tags: - attack.defense-evasion - attack.t1014logsource: category: driver_load product: windowsdetection: selection: Signed: false condition: selectionfalsepositives: - "Driver development and test-signing workstations, where engineers routinely load self-signed or entirely unsigned drivers with test signing mode enabled — the dominant source on any fleet with an engineering population." - "Legitimately signed drivers that Sysmon still reports as unsigned because the load-time WinVerifyTrust catalog check could not complete — most commonly a host with no internet access for the certificate-revocation check at boot, which is a known Sysmon signing-verdict caveat rather than anything about the driver itself." - "Older or specialised hardware drivers (industrial equipment, legacy printers and scanners) from vendors that never adopted modern kernel-mode signing requirements, still loaded on hosts kept on an older Windows servicing branch that permits them."level: mediumSplunk · SPL
Run this as a search.
index=* Signed="false"Elastic · ES|QL
Run this as a search.
FROM logs-*| WHERE TO_LOWER(file.code_signature.signed) == "false"
Wazuh · XML rule
Deploy to your manager — this is a rule, not a search.
<group name="sigma,windows,driver_load,"> <!-- Rule ids must be unique on your manager; 100000+ is the user range. --> <rule id="100000" level="7"> <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. --> <field name="Signed" type="pcre2">(?i)^false$</field> <description>Unsigned kernel driver loaded</description> <mitre> <id>T1014</id> </mitre> </rule></group>
Sentinel · KQL
Run this as a search.
Sentinel cannot express this construct. No Sentinel table is modelled for this logsource ({"category":"driver_load","product":"windows"}), so there is nothing honest to query. Pick a logsource this translator maps, or write the KQL by hand. The Sigma source is on the first tab, unchanged.
Verdicts · reactions · comments
Community
Verdicts from engineers who actually deployed it, and the conversation around it.
Log in to react
Not yet reported on
Nobody has run this in a real environment and said what happened.
Verdicts from engineers who deployed it
0 castNo verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.
Log in to report a verdict.
Log in to join the discussion.
No comments yet. Someone who deploys this will have something to say about it.