{ "changes": [ { "code": "kernel_driver_updated", "consider": [ "The old and new version or path on the event.", "Windows Update history and the product's own update log for the same time." ], "explanation": "The version is read from the file on disk, checked about once an hour, so this can appear up to an hour after the file changed, and the file can be newer than the copy in memory until the driver reloads. Defender platform updates and Windows Update are the usual sources. A forward version from the same publisher, still trusted, is marked as maintenance; a move to a file Windows does not accept reads as a Warning, as such a load does.", "impact": "A new driver version is the first suspect when a device or the whole machine starts failing soon after, including blue screens.", "label": "Kernel driver updated", "scenario": "A graphics driver update moves the driver to a new driver store folder at a newer version.", "summary": "A loaded driver's file changed version or location." }, { "code": "kernel_driver_loaded", "consider": [ "The driver's file, publisher, signer and signature status on the event.", "Whether a tool someone just ran explains it: Process Monitor, a hardware utility or a hypervisor loads its driver on start.", "The Kernel driver installed event for the same driver, when it was also newly installed." ], "explanation": "The agent checks the Service Control Manager's list of loaded drivers every minute, and a load waits one more check before it is reported, so a driver loaded for less than about a minute does not appear; Kernel driver installed reports short-lived drivers. Plugging in hardware, starting a tool and installing software are the usual sources. Loads during startup are not reported. This list is what Windows reports, so it is an inventory and not a rootkit check.", "impact": "A driver runs with full control of the machine, so a new one is the first suspect when a machine starts crashing or a security tool stops working, and an unsigned one needs explaining.", "label": "Kernel driver loaded", "scenario": "A technician starts Process Monitor on a server, and its driver loads.", "summary": "A kernel or file-system driver loaded on this machine." }, { "code": "kernel_driver_unloaded", "consider": [ "How long it was loaded, and whether the event says the agent watched it start.", "Whether the product that owns the driver was stopped or removed on purpose." ], "explanation": "A driver has to stay gone for a couple of minutes before this is reported, so one that reloads quickly during an update does not appear. Closing a tool, unplugging hardware and stopping a product are the usual sources.", "impact": "A driver that leaves takes its function with it: a filter driver unloading can mean a security or backup tool stopped working.", "label": "Kernel driver unloaded", "scenario": "Process Monitor closes after half an hour, and its driver unloads.", "summary": "A kernel or file-system driver unloaded from this machine." }, { "code": "kernel_driver_installed", "consider": [ "The image path and start type on the event: a driver in a user, temp or download folder deserves a closer look.", "Whether software installed or updated at that time explains it.", "The Kernel driver loaded event for the same driver, which says whether it stayed loaded." ], "explanation": "This comes from Service Control Manager event 7045 in the System log, so it reports a driver the once-a-minute check of loaded drivers never saw. The record means the driver's entry was registered, not that the driver ran. It can appear a few minutes after the install. A tool that leaves its service in place logs no record when it loads the driver again, and when one driver is installed over and over the separate changes stop, and Kernel driver installed repeatedly takes over. If the agent was not running for more than an hour, installs in that gap are not reported, though the System log still holds them.", "impact": "A driver runs with full control of the machine, so a new one is the first suspect when a machine starts crashing or a security tool stops working, even if it was gone a moment later.", "label": "Kernel driver installed", "scenario": "A hardware monitoring tool installs its driver when it starts.", "summary": "A kernel or file-system driver was installed on this machine." } ], "conditions": [ { "code": "kernel_driver_flapping", "consider": [ "What loads the driver: the program or service that installed it, and whether that program is restarting.", "The driver's publisher, signer and file on its row.", "Whether Kernel driver installed repeatedly is reported too, which means something is installing the driver again and again." ], "ends": "Ends when the driver has loaded 1 or fewer times in the past hour, and stays there for 1 hour.", "explanation": "The agent checks the loaded drivers once a minute, and past 4 loads in an hour the separate load and unload changes for this driver stop until the count falls. Security and monitoring tools restarting in a loop are a common cause. A Windows component is never reported here, but Microsoft-signed tools such as Process Monitor and Sysmon are. A driver loaded for less than about a minute is not counted; Kernel driver installed repeatedly covers those.", "impact": "This is not normal for a driver. It is often a crashing or restarting driver or tool, and whatever depends on the driver loses it each time it goes.", "label": "Kernel driver loading repeatedly", "scenario": "A security agent stuck in a restart loop loads and unloads its filter driver five times in an hour.", "severity": { "from": "Notice", "to": "Notice" }, "severityText": "Notice from 4 loads in an hour; it does not become more severe.", "summary": "A kernel driver keeps loading and unloading." }, { "code": "kernel_driver_installed_repeatedly", "consider": [ "Which program owns the driver: the name and image path on the driver's last Kernel driver installed event.", "Whether that program is meant to be on this machine.", "If it is, and your fleet runs it everywhere, turn this reason off for those machines." ], "ends": "Ends when the driver has been installed 3 or fewer times in the past hour, and stays there for 1 hour.", "explanation": "Hardware monitoring and overclocking tools often install a small driver, use it for a second and remove it, once a minute. The once-a-minute check of loaded drivers misses a driver that short-lived, so this counts Service Control Manager event 7045 in the System log. Past 10 installs in an hour the separate changes stop, so the true rate is here. A tool that keeps its service in place logs no record, so it is not counted. Minifilter reinstalls are not counted: fast ones are normal security software updating itself. This is not a vulnerable-driver check.", "impact": "Usually nothing is wrong: this is how some monitoring tools work. It matters when no tool on the machine explains it, because a driver that loads for a second can do anything a driver can.", "label": "Kernel driver installed repeatedly", "scenario": "A hardware monitoring tool reinstalls its driver every minute for an hour.", "severity": { "from": "Display", "to": "Display" }, "severityText": "Display from 10 installs in an hour; it does not become more severe.", "summary": "A kernel driver is being installed over and over." } ], "fieldGroups": [ { "id": "driver", "title": "Driver" }, { "id": "file", "title": "File" }, { "id": "signature", "title": "Signature" }, { "id": "loading", "title": "Loading" }, { "id": "condition_age", "title": "Condition age" } ], "fieldPrefix": "sparklogs.data.kernel_drivers.", "fields": [ { "doc": "The OS's name for the driver. On Windows, its service name as Windows spells it. This inventory lists what the Service Control Manager reports as loaded: a driver with no service entry does not appear, so this is not a rootkit check.", "group": "driver", "name": "name", "type": "string" }, { "doc": "The driver's display name, as the Service Control Manager reports it.", "group": "driver", "name": "display_name", "type": "string" }, { "doc": "What kind of driver this is: `kernel`, `file_system` (minifilters included), `recognizer`, or `unknown` for a type this agent does not name.", "group": "driver", "name": "driver_type", "type": "string" }, { "doc": "The service type number Windows reports for the driver.", "group": "driver", "name": "driver_type_code", "type": "integer" }, { "doc": "When the driver is configured to load: `boot`, `system`, `auto`, `manual` or `disabled`. On Windows, absent when its configuration could not be read.", "group": "driver", "name": "start_type", "type": "string" }, { "doc": "The driver's load order group, such as `FSFilter Bottom`. Empty when it names none; on Windows, absent when its configuration could not be read.", "group": "driver", "name": "load_order_group", "type": "string" }, { "doc": "The altitude of the driver's default minifilter instance, as the registry spells it: where it sits in the file system filter stack. Absent for a driver that is not a registered minifilter.", "group": "driver", "name": "filter_altitude", "type": "string" }, { "doc": "Which of Microsoft's documented minifilter groups the altitude falls in, such as `anti_virus` or `activity_monitor`; `unknown` when it falls in none. Absent for a driver that is not a registered minifilter.", "group": "driver", "name": "filter_class", "type": "string" }, { "doc": "The driver's `ImagePath` registry value, as configured. Empty when the value is not set, which means Windows loads the driver from `System32\\drivers`; on Windows, absent when its configuration could not be read.", "group": "file", "name": "image_path_raw", "type": "string" }, { "doc": "The driver file on this machine, which the file facts below describe. Absent when the configured path is not a local drive path; such a file is never opened.", "group": "file", "name": "image_path", "type": "string" }, { "doc": "The file's version resource. This is the file on disk, which can differ from the copy in memory after an update until the driver reloads. Absent until the agent has read the file since it started, and for a file with no version resource.", "group": "file", "name": "file_version", "type": "string" }, { "doc": "The company named in the file's version resource: the vendor, where the signer of a hardware-certified driver is Microsoft. Absent until the agent has read the file since it started, and when the file names none.", "group": "file", "name": "publisher", "type": "string" }, { "doc": "Who signed the file: the common name on the certificate of the signature Windows accepted. Hardware-certified drivers read `Microsoft Windows Hardware Compatibility Publisher`, so read `publisher` for the vendor. Absent until a check has accepted a signature.", "group": "signature", "name": "signer", "type": "string" }, { "doc": "Where the signature that was checked lives: `catalog` (a Windows catalog holds the file's hash) or `embedded` (in the file). Absent until a check has answered.", "group": "signature", "name": "signature_type", "type": "string" }, { "doc": "What the signature check found: `trusted`, `unsigned`, `untrusted` (a signature Windows rejects), `test_signed` (it chains to a test root, so test signing is on) or `timed_out` (the check did not finish). The check uses no network, so revocation is not checked. Absent until a check has answered since the agent started.", "group": "signature", "name": "signature_status", "type": "string" }, { "doc": "The result Windows gave for a file it did not accept. Present for `unsigned`, `untrusted` and `test_signed`.", "group": "signature", "name": "signature_error_code", "type": "integer" }, { "doc": "The name of the result, such as `TRUST_E_NOSIGNATURE`. Absent when it has no known name.", "group": "signature", "name": "signature_error_name", "type": "string" }, { "doc": "The code table that named the result: `trust` or `crypt`. Absent when it has no known name.", "group": "signature", "name": "signature_error_space", "type": "string" }, { "doc": "When the agent first saw the driver loaded, in this boot. A driver loaded for less than about a minute has no row; `kernel_driver_installed` reports a short-lived driver from its System log record.", "group": "loading", "name": "loaded_since_ts", "type": "string", "unit": "timestamp" }, { "doc": "How far `loaded_since_ts` can be trusted: `onset` when the agent watched the load happen, `observed` when the driver was already loaded at the first look of a boot or loaded while the agent was not running.", "group": "loading", "name": "loaded_since_basis", "type": "string" }, { "doc": "How many times this driver loaded in the last hour of this boot. A load counts once it has lasted to the next capture, after an unload that lasted past the absence grace, so a short blink never counts.", "group": "loading", "name": "load_count_1h", "type": "integer", "unit": "count", "usedBy": [ "kernel_driver_flapping" ] }, { "doc": "How long the driver was loaded, from when the agent first saw it to the first capture that missed it: within about a minute either way, and much less than the truth when `loaded_since_basis` is `observed`. Present only on `kernel_driver_unloaded`.", "group": "loading", "name": "loaded_for_s", "type": "integer", "unit": "seconds" }, { "counts": { "lastTsField": "install_last_seen_ts", "lqlFilter": "sparklogs.reason_variant=\"kernel_driver\"", "reasons": [ "service_installed" ] }, "doc": "How many times this driver was installed in the last hour, from Service Control Manager event 7045. Each record means the driver's entry was registered, not that it ran. A tool that keeps its service key logs no record for later loads, and a minifilter's reinstalls are not counted. Absent until the System log has been read, and when it has not been read lately.", "group": "loading", "name": "install_count_1h", "type": "integer", "unit": "count", "usedBy": [ "kernel_driver_installed_repeatedly" ] }, { "doc": "When the newest record counted in `install_count_1h` was written. Absent when the hour holds none.", "group": "loading", "name": "install_last_seen_ts", "type": "string", "unit": "timestamp" }, { "doc": "`onset`: start watched live. `observed`: already present when first noticed, making age a lower bound. `unknown_ongoing`: no meaningful onset time.", "group": "condition_age", "name": "kernel_driver_flapping_age_basis", "type": "string" }, { "doc": "How long this condition has been open, in hours.", "group": "condition_age", "name": "kernel_driver_flapping_age_h", "type": "float", "unit": "hours" }, { "doc": "`onset`: start watched live. `observed`: already present when first noticed, making age a lower bound. `unknown_ongoing`: no meaningful onset time.", "group": "condition_age", "name": "kernel_driver_installed_repeatedly_age_basis", "type": "string" }, { "doc": "How long this condition has been open, in hours.", "group": "condition_age", "name": "kernel_driver_installed_repeatedly_age_h", "type": "float", "unit": "hours" } ], "name": "Kernel drivers", "occurrences": [], "page": "/docs/it-fleet-intelligence/reference/topics/kernel-drivers", "status": "live", "summary": "The kernel and file-system drivers loaded on the host, with their files, signatures and changes.", "topic": "kernel_drivers" }