Sysmon Event ID 6


6: Driver loaded

This is an event from Sysmon.

On this page

The driver loaded events provides information about a driver being loaded on the system. The configured hashes are provided as well as signature information. The signature is created asynchronously for performance reasons and indicates if the file was removed after loading.

Free Security Log Resources by Randy

Description Fields in 6

  • Log Name
  • Source
  • Date
  • Event ID
  • Task Category
  • Level
  • Keywords
  • User
  • Computer
  • Description
  • UtcTime
  • ImageLoaded
  • Hashes
  • Signed
  • Signature
  • SignatureStatus

Supercharger Free Edition

Centrally manage WEC subscriptions.



Examples of 6

Driver loaded:
UtcTime: 2017-04-28 21:33:47.345
ImageLoaded: C:\Windows\System32\drivers\usbscan.sys
Hashes: SHA256=D97DB59C9CAE2B8B33C707E8CEA7A65BF88712842CC715D270F7432A99D21BB6
Signed: true
Signature: Microsoft Windows
SignatureStatus: Valid


Event XML:
<Event xmlns="">
        <Provider Name="Microsoft-Windows-Sysmon" Guid="{5770385F-C22A-43E0-BF4C-06F5698FFBD9}" />
        <TimeCreated SystemTime="2017-04-28T21:33:47.350855600Z" />
        <Correlation />
        <Execution ProcessID="3216" ThreadID="3980" />
        <Security UserID="S-1-5-18" />
        <Data Name="UtcTime">2017-04-28 21:33:47.345</Data>
        <Data Name="ImageLoaded">C:\Windows\System32\drivers\usbscan.sys</Data>
        <Data Name="Hashes">SHA256=D97DB59C9CAE2B8B33C707E8CEA7A65BF88712842CC715D270F7432A99D21BB6</Data>
        <Data Name="Signed">true</Data>
        <Data Name="Signature">Microsoft Windows</Data>
        <Data Name="SignatureStatus">Valid</Data>

Top 10 Windows Security Events to Monitor

Free Tool for Windows Event Collection


Additional Resources