Driver Dropped by Untrusted Executable

[rule]
description = """
Identifies the creation of a driver file by an untrusted program and subsequently loaded in the kernel. Adversaries may
bring a driver onto a compromised machine to execute code with the highest privileges.
"""
id = "3f1cbf09-dba1-428d-8c84-a86db573889e"
license = "Elastic License v2"
name = "Driver Dropped by Untrusted Executable"
os_list = ["windows"]
reference = ["https://www.elastic.co/security-labs/forget-vulnerable-drivers-admin-is-all-you-need"]
version = "1.0.35"

query = '''
sequence with maxspan=5m 
 [process where event.action == "start" and 
  (process.code_signature.trusted == false or process.code_signature.exists == false) and 
  (process.Ext.relative_file_creation_time <= 3600 or process.Ext.relative_file_name_modify_time <= 500) and
  process.hash.sha256 != "bb3468b6c88b0553d039ec3c4e6a13aa9ce500d6962ca906dfda57b7deafcfa9"] as event0
 [file where event.action != "deletion" and
  (file.extension : "sys" or file.Ext.header_bytes : "4d5a*") and 
   process.entity_id == event0.process.entity_id and 
  (process.code_signature.trusted == false or process.code_signature.exists == false)] as event1
 [library where process.pid == 4 and 
  startswith~(dll.path, event1.file.path) and 
  not (dll.code_signature.subject_name : ("FinalWire Kft.", "Musaruba US LLC") and dll.code_signature.trusted == true)]
'''

min_endpoint_version = "8.10.0"
reputation = true
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1068"
name = "Exploitation for Privilege Escalation"
reference = "https://attack.mitre.org/techniques/T1068/"

[[threat.technique]]
id = "T1543"
name = "Create or Modify System Process"
reference = "https://attack.mitre.org/techniques/T1543/"
[[threat.technique.subtechnique]]
id = "T1543.003"
name = "Windows Service"
reference = "https://attack.mitre.org/techniques/T1543/003/"



[threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1014"
name = "Rootkit"
reference = "https://attack.mitre.org/techniques/T1014/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.0"