WinDivert Driver Load Detection

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•27

Detects the loading of the WinDivert driver, which is a powerful user-mode package for Windows capable of capturing, sniffing, modifying, blocking, and re-injecting network traffic. This driver can be used by adversaries for network sniffing, credential access, and defense evasion techniques.