LoFP LoFP / false positives may be present based on legitimate third party applications needing to install drivers. filter, or allow list known good drivers consistently being installed in these paths.

Techniques

Sample rules

Windows Driver Load Non-Standard Path

Description

The following analytic detects the loading of new Kernel Mode Drivers from non-standard paths using Windows EventCode 7045. It identifies drivers not located in typical directories like Windows, Program Files, or SystemRoot. This activity is significant because adversaries may use these non-standard paths to load malicious or vulnerable drivers, potentially bypassing security controls. If confirmed malicious, this could allow attackers to execute code at the kernel level, escalate privileges, or maintain persistence within the environment, posing a severe threat to system integrity and security.

Detection logic

`wineventlog_system` EventCode=7045 ServiceType="kernel mode driver" 
| regex ImagePath!="(?i)^(\w:\\\\Windows\\\\
|\w:\\\\Program\sFile
|\\\\systemroot\\\\
|%SystemRoot%
|system32\\\\)" 
| stats count min(_time) as firstTime max(_time) as lastTime by Computer EventCode ImagePath ServiceName ServiceType  
| rename Computer as dest  
| `security_content_ctime(firstTime)`  
| `security_content_ctime(lastTime)`  
| `windows_driver_load_non_standard_path_filter`