Kernel drivers
6readings
2conditions
1themes fed
Livestatus
The kernel and file-system drivers loaded on the host, with their files, signatures and changes.
Topic id: kernel_drivers.
How conditions work:one episode per stretch of trouble, rated by how bad it gets and how long it lasts.Device Health Conditions
Conditions (2)
Select a condition for background, what to check and an example.
Noticekernel_driver_flapping What it is
A kernel driver keeps loading and unloading.Why it matters
This is not normal for a driver. It is often a crashing or restarting driver or tool, and whatever depends on the driver loses it each time it goes.Notice
In practice
The agent checks the loaded drivers once a minute, and past 4 loads in an hour the separate load and unload changes for this driver stop until the count falls. Security and monitoring tools restarting in a loop are a common cause. A Windows component is never reported here, but Microsoft-signed tools such as Process Monitor and Sysmon are. A driver loaded for less than about a minute is not counted; Kernel driver installed repeatedly covers those.
What to check
- What loads the driver: the program or service that installed it, and whether that program is restarting.
- The driver's publisher, signer and file on its row.
- Whether Kernel driver installed repeatedly is reported too, which means something is installing the driver again and again.
Example
A security agent stuck in a restart loop loads and unloads its filter driver five times in an hour.- Started 0mNoticeCrossed its bar and held long enough to open.started; kernel driver "Contoso Endpoint Filter" loads in the last hour 4 (threshold 4)load_count_1h 4
Event as stored
kernel_drivers: kernel_driver_flapping: NOTABLE: started; kernel driver "Contoso Endpoint Filter" loads in the last hour 4 (threshold 4) - Cleared +117mInfoStayed clear long enough; the episode closed.cleared after 1h56m, peaked Notice, relapses 0; kernel_driver "contosoflt" loads in the last hour 0 (clears at 1)load_count_1h 0
Event as stored
kernel_drivers: kernel_driver_flapping: RECOVERED: cleared after 1h56m, peaked Notice, relapses 0; kernel_driver "contosoflt" loads in the last hour 0 (clears at 1)
How it ends: Ends when the driver has loaded 1 or fewer times in the past hour, and stays there for 1 hour.
Severity
Notice from 4 loads in an hour; it does not become more severe.
Related reasons
kernel_driver_installed_repeatedly: A driver installed over and over, usually too briefly to show up as a load.service_flapping: A service that keeps crashing.
Displaykernel_driver_installed_repeatedly What it is
A kernel driver is being installed over and over.Why it matters
Usually nothing is wrong: this is how some monitoring tools work. It matters when no tool on the machine explains it, because a driver that loads for a second can do anything a driver can.Display
In practice
Hardware monitoring and overclocking tools often install a small driver, use it for a second and remove it, once a minute. The once-a-minute check of loaded drivers misses a driver that short-lived, so this counts Service Control Manager event 7045 in the System log. Past 10 installs in an hour the separate changes stop, so the true rate is here. A tool that keeps its service in place logs no record, so it is not counted. Minifilter reinstalls are not counted: fast ones are normal security software updating itself. This is not a vulnerable-driver check.
What to check
- Which program owns the driver: the name and image path on the driver's last Kernel driver installed event.
- Whether that program is meant to be on this machine.
- If it is, and your fleet runs it everywhere, turn this reason off for those machines.
Example
A hardware monitoring tool reinstalls its driver every minute for an hour.- Started 0mDisplayCrossed its bar and held long enough to open.started; kernel_driver "winring0_1_2_0" installs in the last hour 10 (threshold 10)install_count_1h 10
Event as stored
kernel_drivers: kernel_driver_installed_repeatedly: NOTABLE: started; kernel_driver "winring0_1_2_0" installs in the last hour 10 (threshold 10) - Cleared +2h19mInfoStayed clear long enough; the episode closed.cleared after 2h19m, peaked Display, relapses 0; kernel_driver "winring0_1_2_0" installs in the last hour 0 (clears at 3)install_count_1h 0
Event as stored
kernel_drivers: kernel_driver_installed_repeatedly: RECOVERED: cleared after 2h19m, peaked Display, relapses 0; kernel_driver "winring0_1_2_0" installs in the last hour 0 (clears at 3)
How it ends: Ends when the driver has been installed 3 or fewer times in the past hour, and stays there for 1 hour.
Severity
Display from 10 installs in an hour; it does not become more severe.
Related reasons
kernel_driver_flapping: A driver loading and unloading, for at least a minute at a time.kernel_driver_installed: One install of a driver.
Changes (4)
This topic reports what the host looks like, so its news is what CHANGED between two reports. Each change below is a named fact you can ask about across the fleet.kernel_driver_updated What it is
A loaded driver's file changed version or location.Why it matters
A new driver version is the first suspect when a device or the whole machine starts failing soon after, including blue screens.In practice
The version is read from the file on disk, checked about once an hour, so this can appear up to an hour after the file changed, and the file can be newer than the copy in memory until the driver reloads. Defender platform updates and Windows Update are the usual sources. A forward version from the same publisher, still trusted, is marked as maintenance; a move to a file Windows does not accept reads as a Warning, as such a load does.
What to check
- The old and new version or path on the event.
- Windows Update history and the product's own update log for the same time.
Example
A graphics driver update moves the driver to a new driver store folder at a newer version.kernel driver updated "Contoso Graphics Driver". old_file_version="31.0.15.4617" new_file_version="31.0.15.5222" old_image_path="...\FileRepository\gfx.inf_amd64_1a\gfxkm.sys" new_image_path="...\FileRepository\gfx.inf_amd64_2b\gfxkm.sys". sparklogs.instance: kernel_driver:gfxkm sparklogs.data.kernel_drivers.name: gfxkm
SparkLogs:
kernel_driver_updated, Notice, kernel_drivers: kernel_driver_updated: NOTABLE: kernel driver updated "Contoso Graphics Driver". old_file_version="31.0.15.4617" new_file_version="31.0.15.5222" old_image_path="...\FileRepository\gfx.inf_amd64_1a\gfxkm.sys" new_image_path="...\FileRepository\gfx.inf_amd64_2b\gfxkm.sys".Related reasons
driver_updated: A driver package moved version.
kernel_driver_loaded What it is
A kernel or file-system driver loaded on this machine.Why it matters
A driver runs with full control of the machine, so a new one is the first suspect when a machine starts crashing or a security tool stops working, and an unsigned one needs explaining.In practice
The agent checks the Service Control Manager's list of loaded drivers every minute, and a load waits one more check before it is reported, so a driver loaded for less than about a minute does not appear; Kernel driver installed reports short-lived drivers. Plugging in hardware, starting a tool and installing software are the usual sources. Loads during startup are not reported. This list is what Windows reports, so it is an inventory and not a rootkit check.
What to check
- The driver's file, publisher, signer and signature status on the event.
- Whether a tool someone just ran explains it: Process Monitor, a hardware utility or a hypervisor loads its driver on start.
- The Kernel driver installed event for the same driver, when it was also newly installed.
Example
A technician starts Process Monitor on a server, and its driver loads.kernel driver loaded "Process Monitor Driver". file_version="4.0.1.0" image_path="C \Windows\System32\Drivers\PROCMON24.SYS" publisher="Sysinternals - www.sysinternals.com" signer="Microsoft Corporation" signature_status="trusted". sparklogs.instance: kernel_driver:procmon24 sparklogs.data.kernel_drivers.name: PROCMON24
SparkLogs:
kernel_driver_loaded, Notice, kernel_drivers: kernel_driver_loaded: NOTABLE: kernel driver loaded "Process Monitor Driver". file_version="4.0.1.0" image_path="C \Windows\System32\Drivers\PROCMON24.SYS" publisher="Sysinternals - www.sysinternals.com" signer="Microsoft Corporation" signature_status="trusted".Related reasons
driver_installed: A driver package installed for a device.kernel_driver_installed: The System log's record of the driver being installed.kernel_driver_unloaded: The same driver leaving.
kernel_driver_unloaded What it is
A kernel or file-system driver unloaded from this machine.Why it matters
A driver that leaves takes its function with it: a filter driver unloading can mean a security or backup tool stopped working.In practice
A driver has to stay gone for a couple of minutes before this is reported, so one that reloads quickly during an update does not appear. Closing a tool, unplugging hardware and stopping a product are the usual sources.
What to check
- How long it was loaded, and whether the event says the agent watched it start.
- Whether the product that owns the driver was stopped or removed on purpose.
Example
Process Monitor closes after half an hour, and its driver unloads.kernel driver unloaded "Process Monitor Driver". file_version="4.0.1.0" image_path="C \Windows\System32\Drivers\PROCMON24.SYS" publisher="Sysinternals - www.sysinternals.com" signer="Microsoft Corporation" signature_status="trusted" loaded_for_s="1800". sparklogs.instance: kernel_driver:procmon24 sparklogs.data.kernel_drivers.name: PROCMON24
SparkLogs:
kernel_driver_unloaded, Notice, kernel_drivers: kernel_driver_unloaded: NOTABLE: kernel driver unloaded "Process Monitor Driver". file_version="4.0.1.0" image_path="C \Windows\System32\Drivers\PROCMON24.SYS" publisher="Sysinternals - www.sysinternals.com" signer="Microsoft Corporation" signature_status="trusted" loaded_for_s="1800".Related reasons
kernel_driver_loaded: The same driver arriving.
kernel_driver_installed What it is
A kernel or file-system driver was installed on this machine.Why it matters
A driver runs with full control of the machine, so a new one is the first suspect when a machine starts crashing or a security tool stops working, even if it was gone a moment later.In practice
This comes from Service Control Manager event 7045 in the System log, so it reports a driver the once-a-minute check of loaded drivers never saw. The record means the driver's entry was registered, not that the driver ran. It can appear a few minutes after the install. A tool that leaves its service in place logs no record when it loads the driver again, and when one driver is installed over and over the separate changes stop, and Kernel driver installed repeatedly takes over. If the agent was not running for more than an hour, installs in that gap are not reported, though the System log still holds them.
What to check
- The image path and start type on the event: a driver in a user, temp or download folder deserves a closer look.
- Whether software installed or updated at that time explains it.
- The Kernel driver loaded event for the same driver, which says whether it stayed loaded.
Example
A hardware monitoring tool installs its driver when it starts.kernel driver installed "WinRing0_1_2_0". image_path="\??\C \Tools\WinRing0x64.sys" start_type="demand start". sparklogs.instance: kernel_driver:winring0_1_2_0 sparklogs.data.kernel_drivers.name: winring0_1_2_0
SparkLogs:
kernel_driver_installed, Notice, kernel_drivers: kernel_driver_installed: NOTABLE: kernel driver installed "WinRing0_1_2_0". image_path="\??\C \Tools\WinRing0x64.sys" start_type="demand start".Related reasons
driver_installed: A driver package installed for a device; one install can report both.kernel_driver_installed_repeatedly: The same driver installed again and again.kernel_driver_loaded: The driver loaded and staying.
Fields (28)
Each driver the Service Control Manager reports as loaded, with its file, version, publisher, signature and minifilter placement. A load shorter than about a minute is not reported, and a driver with no service entry is not listed, so this is an inventory and not a rootkit check. Installs come from Service Control Manager event 7045: a tool that keeps its service entry logs none on later loads. Minifilter reinstalls are not counted.
Full inventory every day. Supported changes are reported when the agent observes them.
Driver (8)
sparklogs.data.kernel_drivers. namesparklogs.data.kernel_drivers. display_name sparklogs.data.kernel_drivers. driver_type kernel, file_system (minifilters included), recognizer, or unknown for a type this agent does not name.sparklogs.data.kernel_drivers. driver_type_code sparklogs.data.kernel_drivers. start_type boot, system, auto, manual or disabled. On Windows, absent when its configuration could not be read.sparklogs.data.kernel_drivers. load_order_group FSFilter Bottom. Empty when it names none; on Windows, absent when its configuration could not be read.File (4)
sparklogs.data.kernel_drivers. image_path_raw ImagePath registry value, as configured. Empty when the value is not set, which means Windows loads the driver from System32\drivers; on Windows, absent when its configuration could not be read.sparklogs.data.kernel_drivers. image_path sparklogs.data.kernel_drivers. file_version sparklogs.data.kernel_drivers. publisherSignature (6)
sparklogs.data.kernel_drivers. signerMicrosoft Windows Hardware Compatibility Publisher, so read publisher for the vendor. Absent until a check has accepted a signature.sparklogs.data.kernel_drivers. signature_type catalog (a Windows catalog holds the file's hash) or embedded (in the file). Absent until a check has answered.sparklogs.data.kernel_drivers. signature_status trusted, unsigned, untrusted (a signature Windows rejects), test_signed (it chains to a test root, so test signing is on) or timed_out (the check did not finish). The check uses no network, so revocation is not checked. Absent until a check has answered since the agent started.sparklogs.data.kernel_drivers. signature_error_code unsigned, untrusted and test_signed.sparklogs.data.kernel_drivers. signature_error_name TRUST_E_NOSIGNATURE. Absent when it has no known name.sparklogs.data.kernel_drivers. signature_error_space trust or crypt. Absent when it has no known name.Loading (6)
sparklogs.data.kernel_drivers. loaded_since_ts kernel_driver_installed reports a short-lived driver from its System log record.sparklogs.data.kernel_drivers. loaded_since_basis loaded_since_ts can be trusted: onset when the agent watched the load happen, observed when the driver was already loaded at the first look of a boot or loaded while the agent was not running.sparklogs.data.kernel_drivers. load_count_1h sparklogs.data.kernel_drivers. loaded_for_s loaded_since_basis is observed. Present only on kernel_driver_unloaded.sparklogs.data.kernel_drivers. install_count_1h service_installed records matching sparklogs.reason_variant="kernel_driver"; the latest is install_last_seen_ts.sparklogs.data.kernel_drivers. install_last_seen_ts install_count_1h was written. Absent when the hour holds none.Condition age (4)
sparklogs.data.kernel_drivers. kernel_driver_flapping_age_basis onset: start watched live. observed: already present when first noticed, making age a lower bound. unknown_ongoing: no meaningful onset time.sparklogs.data.kernel_drivers. kernel_driver_flapping_age_h sparklogs.data.kernel_drivers. kernel_driver_installed_repeatedly_age_basis onset: start watched live. observed: already present when first noticed, making age a lower bound. unknown_ongoing: no meaningful onset time.sparklogs.data.kernel_drivers. kernel_driver_installed_repeatedly_age_h Example
Inventory (every day)
2 loaded drivers.
sparklogs.data.kernel_drivers.name: ContosoFlt
sparklogs.data.kernel_drivers.image_path: C:\Windows\System32\drivers\contosoflt.sys
sparklogs.data.kernel_drivers.start_type: manual
sparklogs.data.kernel_drivers.load_count_1h: 0
SparkLogs: CONTEXT, Info, kernel_drivers: INVENTORY: 2 loaded drivers.