LoFP / false positives will be present. drill down into the driver further by version number and cross reference by signer. review the reference material in the lookup. in addition, modify the query to look within specific paths, which will remove a lot of \"normal\" drivers.

Techniques

• T1543.003

Sample rules

Windows Vulnerable Driver Installed

• source: splunk
• technicques:
  • T1543.003

Description

The following analytic detects the loading of known vulnerable Windows drivers, which may indicate potential persistence or privilege escalation attempts. It leverages Windows System service install EventCode 7045 to identify driver loading events and cross-references them with a list of vulnerable drivers. This activity is significant as attackers often exploit vulnerable drivers to gain elevated privileges or maintain persistence on a system. If confirmed malicious, this could allow attackers to execute arbitrary code with high privileges, leading to further system compromise and potential data exfiltration. This detection is a Windows Event Log adaptation of the Sysmon driver loaded detection written by Michael Haag.

Detection logic

`wineventlog_system` EventCode=7045 ServiceType="kernel mode driver" 
| table _time dest EventCode ImagePath ServiceName ServiceType 
| lookup loldrivers driver_name AS ImagePath OUTPUT is_driver driver_description 
| search is_driver = TRUE  
| `windows_vulnerable_driver_installed_filter`

Windows Vulnerable Driver Loaded

• source: splunk
• technicques:
  • T1543.003

Description

The following analytic detects the loading of known vulnerable Windows drivers, which may indicate potential persistence or privilege escalation attempts. It leverages Sysmon EventCode 6 to identify driver loading events and cross-references them with a list of vulnerable drivers. This activity is significant as attackers often exploit vulnerable drivers to gain elevated privileges or maintain persistence on a system. If confirmed malicious, this could allow attackers to execute arbitrary code with high privileges, leading to further system compromise and potential data exfiltration.

Detection logic

`sysmon` EventCode=6  
| stats  min(_time) as firstTime max(_time) as lastTime count by dest ImageLoaded 
| lookup loldrivers driver_name AS ImageLoaded OUTPUT is_driver driver_description 
| search is_driver = TRUE 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `windows_vulnerable_driver_loaded_filter`