LoFP / false positives will be present. filter as needed.

Techniques

• T1068

Sample rules

Windows System File on Disk

• source: splunk
• technicques:
  • T1068

Description

The following analytic detects the creation of new .sys files on disk. It leverages the Endpoint.Filesystem data model to identify and log instances where .sys files are written to the filesystem. This activity is significant because .sys files are often used as kernel mode drivers, and their unauthorized creation can indicate malicious activity such as rootkit installation. If confirmed malicious, this could allow an attacker to gain kernel-level access, leading to full system compromise, persistent control, and the ability to bypass security mechanisms.

Detection logic

| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
  WHERE Filesystem.file_name="*.sys*"
  BY Filesystem.action Filesystem.dest Filesystem.file_access_time
     Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time
     Filesystem.file_name Filesystem.file_path Filesystem.file_acl
     Filesystem.file_size Filesystem.process_guid Filesystem.process_id
     Filesystem.user Filesystem.vendor_product

| `drop_dm_object_name(Filesystem)`

| `security_content_ctime(firstTime)`

| `security_content_ctime(lastTime)`

| `windows_system_file_on_disk_filter`