Sysmon Event ID 6 — Driver loaded — SecOps Tools

Why event 6 matters

Rootkits and kernel-level implants load malicious drivers. BYOVD (Bring Your Own Vulnerable Driver) attacks load legitimate but vulnerable drivers to exploit for kernel code execution. Tools: TDSSKiller, LOLDrivers. Unsigned drivers or drivers from suspicious paths are critical indicators.

How to detect it

Alert: Signed=false. Alert: ImageLoaded from user writable paths. Alert: known vulnerable drivers from LOLDrivers list. Very low false-positive rate for unsigned drivers in modern Windows.

Log source

Microsoft-Windows-Sysmon/Operational

Requires Sysmon installed with a config that logs this event (e.g. SwiftOnSecurity / Olaf Hartong).

Fields to pivot on

ImageCommandLineParentImageUserHashes

MITRE ATT&CK mapping

Tactic	Technique
Persistence	Kernel Modules and Extensions (T1547.006)
Defense Evasion	Rootkit (T1014)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sigma rule

title: Unsigned Driver Loaded
status: stable
description: Unsigned kernel driver loaded — possible rootkit or BYOVD attack
author: theadminstack.com
date: 2026/05/16
logsource:
    category: driver_load
    product: windows
detection:
    selection:
        Signed: 'false'
    condition: selection
falsepositives:
    - Development environments
    - Some legitimate but unsigned hardware drivers
level: high
tags:
    - attack.persistence
    - attack.t1547.006
    - attack.defense_evasion

Sentinel / Defender KQL

Event
| where EventLog == "Microsoft-Windows-Sysmon/Operational" and EventID == 6   // Driver loaded
// EventData holds: Image, CommandLine, ParentImage, User, Hashes
| project TimeGenerated, Computer, RenderedDescription
| sort by TimeGenerated desc

Splunk SPL

index=* sourcetype="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=6
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# Driver loaded — add EventData fields: Image, CommandLine, ParentImage, User`

Hunt event 6 in Sentinel/Defender →

Build a KQL query for this event in the KQL Query Builder.

Search all event IDs →

Open the interactive Windows Event ID lookup.

Frequently asked questions

What is Sysmon Event ID 6?

Driver loaded. A kernel driver was loaded. ImageLoaded (driver path), Hashes, Signed, Signature are key.

Which log records event 6?

Event 6 is written to the Microsoft-Windows-Sysmon/Operational channel by Microsoft-Windows-Sysmon. Requires Sysmon installed with a config that logs this event (e.g. SwiftOnSecurity / Olaf Hartong).

What MITRE ATT&CK techniques map to event 6?

Event 6 is associated with: Kernel Modules and Extensions (T1547.006), Rootkit (T1014).

How do you detect activity around event 6?

Alert: Signed=false. Alert: ImageLoaded from user writable paths. Alert: known vulnerable drivers from LOLDrivers list. Very low false-positive rate for unsigned drivers in modern Windows.