Event ID 6
Provides information about a driver being loaded on the systemSource:
Microsoft-Windows-Sysmon
Category:
Driver loaded (rule: DriverLoad)
Driver loaded: RuleName: %1!s! UtcTime: %2!s! ImageLoaded: %3!s! Hashes: %4!s! Signed: %5!s! Signature: %6!s! SignatureStatus: %7!s!
The driver loaded events provides information about a driver being loaded on the system. The configured hashes are provided as well as signature information. The signature is created asynchronously for performance reasons and indicates if the file was removed after loading.
Auditing:
Always
Due its low volume and valuable insight in driver activity, this event should always be audited.
Volume:
Low
Medium
LEFT/RIGHT arrow keys for navigation
Back to List