Investigation: Known Vulnerable (BYOVD) Driver Loaded By Hash

1. Confirm the alert

   Detects the load of a driver whose SHA256 matches a known-vulnerable (BYOVD) sample from the LOLDrivers corpus, regardless of filename — catches renamed/random-named drops that a filename rule misses. Exact-hash match, near-zero false positive. Forged deterministically. The rule matched on logsource `driver_load`. Verify the event genuinely matches the described behavior, and not a known legitimate case. The rule matches on these fields — examine the exact value in the event:

   • **Hashes** contains: `SHA256=000547560fea0dd4b477eb28bf781ea67bf83c748`, `SHA256=003e61358878c7e49e18420ee0b4a37b51880be40`, `SHA256=0040153302b88bee27eb4f1eca6855039e1a05737`, `SHA256=0052aa88e42055a2eed5ddd17c3499c692360155e` …

2. Pivot: find the origin and context

   Investigation queries (read-only):

   • Loaded driver: signed? revoked? present in LOLDrivers?
   • Driver hash; correlate with the in-house drivers pack

3. Analyze (D3FEND countermeasures)

   Relevant defensive analysis techniques (MITRE D3FEND), to apply where the telemetry is available:

   • Memory Boundary Tracking
   • Shadow Stack Comparisons

4. Rule out false positives

   Known benign causes for this rule:

   • None expected — an exact hash match to a known-vulnerable driver is malicious by definition; revisit only if a vendor re-ships an old vulnerable build under a patched program.

5. Context (threat intelligence)

   The rule's references — CTI context to qualify the incident:

   • https://attack.mitre.org/techniques/T1068/
   • https://loldrivers.io/