Vulnerable WinRing0 Driver Load

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•0•0

Detects the load of a signed WinRing0 driver often used by threat actors, crypto miners (XMRIG) or malware for privilege escalation