Vulnerable WinRing0 Driver Load Detection

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•1•0•34

Detects the load of the WinRing0 driver, which is known to be vulnerable and has been exploited by threat actors, crypto miners (like XMRIG), and other malware for privilege escalation. The detection is based on specific file names or a known IMPHASH associated with the driver.