SOC Event Lookup
Event ID 6DriverP2

Sysmon Event ID 6: Driver loaded

Applicable version
Sysmon 2.0 and later
Last reviewed
2026-07-21

Quick summary

Sysmon Event ID 6 records that a kernel driver was loaded, including the driver's image path, hashes, and Authenticode signature status.

Technical Metadata

Technical metadata for Event ID 6
Event ID6
ProviderMicrosoft-Windows-Sysmon
ChannelMicrosoft-Windows-Sysmon/Operational
LevelInformational
MITRE ATT&CKTA0004 Privilege Escalation / T1068 Exploitation for Privilege Escalation
Key fields to watchSignatureStatus, Signed, Hashes, ImageLoaded

Trigger Scenarios

Sysmon logs Event ID 6 whenever the kernel loads a driver, whether at boot from a legitimate hardware or security vendor, or later through a service installation or an exploited signed driver used to gain kernel access (Bring Your Own Vulnerable Driver, BYOVD).

Key Fields

SignatureStatus

Sysmon's verified Authenticode validation result. A value other than "Valid" (for example "Unsigned" or "Invalid") on a driver load is the direct signal that the kernel accepted unsigned or improperly signed code, which standard Driver Signature Enforcement should have blocked unless test signing or a policy exception is active.

Signed

Boolean companion to SignatureStatus; Signed=false paired with a driver loading from outside %SystemRoot%\System32\drivers is materially higher risk than an unsigned driver in a standard location.

Hashes

SHA256/IMPHASH of the driver image. Match this value against known-vulnerable driver hash lists (LOLDrivers) to catch signed-but-abusable drivers that pass signature checks yet are documented BYOVD vectors.

ImageLoaded

Full path of the driver file. A driver loading from a user-writable path such as %TEMP% or %APPDATA% instead of the driver store is inconsistent with legitimate installation.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Sysmon Event ID 6
Event
| where EventLog == "Microsoft-Windows-Sysmon/Operational" and EventID == 6
| project TimeGenerated, Computer, EventID, RenderedDescription
| order by TimeGenerated desc
Data source
Microsoft Sentinel Event table
Assumptions
The Sysmon Operational channel is collected into Event. Map raw XML fields to the event-specific fields described on this page.
Query reference
Splunk SPL: Retrieve Sysmon Event ID 6
index=sysmon source="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=6
| table _time, host, EventCode, Message
Data source
Splunk Sysmon event data
Assumptions
Index, source, and parsed field names vary by deployment. Apply the event-specific field conditions after validating local field extraction.
Cortex XQL: Retrieve Sysmon Event ID 6
dataset = microsoft_windows_raw
| filter edr_event_id = 6
Data source
Cortex XDR microsoft_windows_raw
Assumptions
Confirm Provider is Microsoft-Windows-Sysmon because event IDs are not globally unique. Inspect raw provider fields because parsed names vary by collection path.
Query reference
Sigma rule: Sysmon Event ID 6
title: Sysmon Event ID 6
status: experimental
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 6
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Sysmon log source
Assumptions
This rule retrieves the event and is not a standalone malicious-behavior detection. Add the documented field conditions and correlations in the destination SIEM.
Query reference

Documented Values and Codes

Documented event values and their security relevance
FieldValueMeaningSecurity relevance
EventID6A kernel driver loaded and Sysmon recorded configured hashes and signature data.Use EventID together with the other documented event fields and correlated activity; this value alone is not proof of compromise. Source
SignatureStatusValidIndicates successful Authenticode signature validation; other values require contextual review.Use SignatureStatus together with the other documented event fields and correlated activity; this value alone is not proof of compromise. Source

MITRE ATT&CK Mapping

  • T1068Exploitation for Privilege Escalation

Detection Notes

T1068 Exploitation for Privilege Escalation through BYOVD is supported when Hashes matches an independently verified vulnerable Windows driver and correlated process or EDR telemetry shows the driver being used to gain kernel capabilities or disable controls. ImageLoaded outside C:\Windows\System32\drivers\ with Signed=false or SignatureStatus=Invalid is triage context, not proof of exploitation. Sysinternals notes signature processing is asynchronous, so an unavailable result is not equivalent to an invalid signature.

Common False Positives

  • New hardware installations and Windows Update driver rollouts generate legitimate Event ID 6 records for signed drivers from standard paths.
  • Security and virtualization vendors ship their own signed kernel drivers that load at every boot.
  • Test-signed drivers on developer workstations with test signing mode enabled will show SignatureStatus other than Valid without malicious intent.

Related Events

Sample Log

Sanitized event sample
UtcTime: 2026-07-12 08:41:19.005
ImageLoaded: C:\Windows\Temp\gdrv.sys
Hashes: SHA256=REDACTED
Signed: false
Signature: -
SignatureStatus: Unsigned

Frequently Asked Questions

What does Sysmon Event ID 6 mean?

A kernel driver loaded on the endpoint.

Does Event ID 6 always indicate malicious activity?

No. Operating-system and vendor drivers generate it routinely; path, hash, signer, and signature status determine risk.

How should Event ID 6 be investigated?

Check ImageLoaded, Hashes, Signed, SignatureStatus, driver prevalence, and the installation process or service.

Sources

Machine-readable JSON