Breadcrumbs

EVID 6 : Driver Loaded (Sysmon)

Event Details

Event Type

Driver Loaded

Event Description

6 : Provides information about a driver being loaded on the system.

Event ID

6

Log Fields and Parsing

This section details the log fields available in this log message type, along with values parsed for both LogRhythm Default and LogRhythm Default v2.0 policies. A value of "N/A" (not applicable) means that there is no value parsed for a specified log field.

Log Field

LogRhythm Default

LogRhythm Default v2.0

Provider

N/A

N/A

EventID

<vmid>

<vmid>

Version

N/A

N/A

Level

<severity>

<severity>

Task

<vendorinfo>

<vendorinfo>

Opcode

N/A

N/A

Keywords

N/A

<result>

TimeCreated 

N/A

N/A

EventRecordID

N/A

N/A

Correlation 

N/A

N/A

Execution 

N/A

N/A

Channel

N/A

N/A

Computer

<sname>

<dname>

Security 

N/A

N/A

ProcessId

N/A

<processid>

Image

N/A

<process>

ImageLoaded

<object>

<object>

SHA256

<objectname>

N/A

Hashes

<session>

<hash>

MD5

<hash>

N/A

Signed

N/A

N/A

Signature

N/A

N/A

SignatureStatus

N/A

N/A

Userid

N/A

N/A

RuleName

N/A

<policy>

Log Processing Settings

This section details log processing changes made from the LogRhythm Default policy to LogRhythm Default v2.0. In some cases, base rules are broken down into sub-rules to appropriately parse log message types by their event types.

LogRhythm Default

Regex ID

Rule Name

Rule Type

Common Events

Classifications

1007453

EVID 6 : Driver Loaded

Base Rule

Configuration Loaded : System

Configuration

LogRhythm Default v2.0 

Regex ID

Rule Name

Rule Type

Common Events

Classifications

1011223

V 2.0 : Object Loaded

Base Rule

Object Initialized

Access Success

V 2.0 : EVID 6 : Driver Loaded

Sub Rule

Object Initialized

Access Success

V 2.0 : EVID 7 : Image Loaded

Sub Rule

Object Initialized

Access Success