Vulnerable HackSys Extreme Vulnerable Driver Load

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•1•0•25

Detects the load of HackSys Extreme Vulnerable Driver (HEVD.sys), an intentionally vulnerable Windows driver often abused by threat actors for privilege escalation and other malicious activities. The rule identifies the driver by its filename and known IMPHASH values.