WinDivert Driver Load (679085d5-f427-4484-9f58-1dc30a7c426d)

Detects the load of the Windiver driver, a powerful user-mode capture/sniffing/modification/blocking/re-injection package for Windows

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
LLMNR/NBT-NS Poisoning and SMB Relay - T1557.001 (650c784b-7504-4df7-ab2c-4ea882384d1e)	Attack Pattern	WinDivert Driver Load (679085d5-f427-4484-9f58-1dc30a7c426d)	Sigma-Rules	1
WinDivert Driver Load (679085d5-f427-4484-9f58-1dc30a7c426d)	Sigma-Rules	Network Address Translation Traversal - T1599.001 (4ffc1794-ec3b-45be-9e52-42dbcb2af2de)	Attack Pattern	1
LLMNR/NBT-NS Poisoning and SMB Relay - T1557.001 (650c784b-7504-4df7-ab2c-4ea882384d1e)	Attack Pattern	Adversary-in-the-Middle - T1557 (035bb001-ab69-4a0b-9f6c-2de8b09e1b9d)	Attack Pattern	2
Network Boundary Bridging - T1599 (b8017880-4b1e-42de-ad10-ae7ac6705166)	Attack Pattern	Network Address Translation Traversal - T1599.001 (4ffc1794-ec3b-45be-9e52-42dbcb2af2de)	Attack Pattern	2