Log Dejargonizer

Sysmon · Event 6

Sysmon Event 6: A kernel driver was loaded

A driver was loaded into the kernel. This is one of the lowest-volume, highest-value events Sysmon produces — a healthy machine loads a stable set of drivers and almost never adds to it, which makes anything new immediately worth reading.

Also written as Sysmon 6Sysmon Event ID 6DriverLoad sysmonsysmon driver loaded event

What it means for you

On a personal computer

Sysmon is not installed by default; if you are seeing this, someone set it up deliberately. It records low-level components loading, which happens when drivers are installed or updated.

For an analyst

The technique this catches is bring-your-own-vulnerable-driver: loading a legitimately signed but flawed driver to get kernel access. The consequence is that Signed=true and a valid signature status prove the driver is authentic, not that it is safe — the drivers used in these attacks are genuinely signed. Hash-based blocklists are the practical control, and this event is how you find out whether one has been loaded. Baseline the driver set per hardware model; on a homogeneous fleet the legitimate list is short and stable, which is what makes this event so productive.

The fields that decide it

Everything else in the log line is context.

ImageLoaded
The path of the driver file. Anything outside System32\drivers is unusual, and a driver loading from a user-writable or temp directory is a finding on its own.
Signature and SignatureStatus
Who signed it and whether the signature validates.
  • Valid, MicrosoftSigned by Microsoft. Authentic, which is not the same as safe — vulnerable drivers used in attacks are authentically signed.
  • Valid, a known hardware vendorOrdinary. Match it against the hardware actually in the machine.
  • Valid, an unfamiliar or unrelated vendorA signed driver with no obvious reason to be on this machine. This is the shape of the bring-your-own-driver technique.
  • Unavailable or ExpiredThe signature could not be checked or has lapsed. On a modern 64-bit Windows this should be rare.
Hashes
The file hash, which is what you check against a vulnerable-driver blocklist. This is the field that turns the event into a decision rather than a question.
Signed
Whether the file carries a signature at all. Useful, and routinely over-trusted — read it alongside the signer name, not instead of it.

Common questions

Is a signed driver safe?

No. A valid signature proves the file is authentic and unmodified, not that it is harmless. A well-established attack technique loads a genuinely signed driver containing a known flaw, then uses that flaw to get kernel access — the signature check passes because the driver really is what it claims to be. Check the hash against a vulnerable-driver blocklist, not just the signature.

How much volume does Sysmon Event 6 generate?

Very little. Most machines load their drivers at boot and add nothing for weeks. That is what makes this event unusually good value: the baseline is small enough to enumerate, and anything outside it is worth a look. Compare it with process or network events, where volume forces aggressive filtering and accepted gaps.

What should I alert on in Sysmon Event 6?

Three things, in order of value. Any driver whose hash appears on a known vulnerable-driver list. Any driver loading from outside System32\drivers, particularly from a user-writable path. And any signer that does not correspond to hardware or software you have deployed. The last needs a baseline first, but the baseline is small.

How do I build a baseline of legitimate drivers?

Collect Event 6 across the fleet for a week and group by hash and signer. On a homogeneous estate the list comes out surprisingly short — a few dozen entries covering the hardware models and security products you run. Anything appearing on one machine and nowhere else is where to start, since legitimate drivers are almost always deployed broadly.

Read next

Vendor documentation

Last reviewed 6 September 2026