Detections & policies

SIEM queries

These examples are retained from the existing LOLDrivers homepage. Follow each source's setup instructions and adapt the query to your environment.

Microsoft Defender

 let LOLDrivers = externaldata (Category:string, KnownVulnerableSamples:dynamic, Verified:string ) [h@"https://www.loldrivers.io/api/drivers.json"]
     with (
       format=multijson,
       ingestionMapping=@'
[
  {"Column":"Category","Properties":{"Path":"$.Category"}},
  {"Column":"KnownVulnerableSamples","Properties":{"Path":"$.KnownVulnerableSamples"}},
  {"Column":"Verified","Properties":{"Path":"$.Verified"}}
]'
     )
| mv-expand KnownVulnerableSamples
| extend SHA1 = tostring(KnownVulnerableSamples.SHA1), SHA256 = tostring(KnownVulnerableSamples.SHA256)
;
// you can filter the drivers further based on category or verified status
DeviceEvents
| where ActionType == "DriverLoad"
| join kind=inner (LOLDrivers | where isnotempty(SHA256)) on SHA256
| union (
  DeviceEvents
  | where ActionType == "DriverLoad"
  | join kind=inner (LOLDrivers | where isnotempty(SHA1)) on SHA1
)

Credit: Mehmet Ergene (@Cyb3rMonk). Original query and setup ↗

Splunk

index=YOUR_INDEX sourcetype=YOUR_DRIVER_LOAD_SOURCE
| stats min(_time) as firstTime max(_time) as lastTime count by ImageLoaded dest dvc process_hash process_path signature signature_id user_id vendor_product
| lookup loldrivers driver_name AS ImageLoaded OUTPUT is_driver driver_description
| search is_driver=TRUE
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_vulnerable_driver_loaded_filter`

Credit: Michael Haag. Detection documentation ↗ · Lookup CSV ↗