Techniques
Sample rules
Windows Driver Load Non-Standard Path
- source: splunk
- technicques:
- T1014
- T1068
Description
The following analytic detects the loading of new Kernel Mode Drivers from non-standard paths using Windows EventCode 7045. It identifies drivers not located in typical directories like Windows, Program Files, or SystemRoot. This activity is significant because adversaries may use these non-standard paths to load malicious or vulnerable drivers, potentially bypassing security controls. If confirmed malicious, this could allow attackers to execute code at the kernel level, escalate privileges, or maintain persistence within the environment, posing a severe threat to system integrity and security.
Detection logic
`wineventlog_system` EventCode=7045 ServiceType="kernel mode driver"
| regex ImagePath!="(?i)^(\w:\\\\Windows\\\\
|\w:\\\\Program\sFile
|\\\\systemroot\\\\
|%SystemRoot%
|system32\\\\)"
| stats count min(_time) as firstTime max(_time) as lastTime by Computer EventCode ImagePath ServiceName ServiceType
| rename Computer as dest
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_driver_load_non_standard_path_filter`