Microsoft Recommended Driver Block List

Author: Cyb3rMonk
Source: github.com/Cyb3r-Monk/Threat-Hunting-and-Detection

The query below detects loading or creation of a vulnerable driver that is listed in the Microsoft recommended driver block rules.

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	No specific technique

References

https://raw.githubusercontent.com/Cyb3r-Monk/Microsoft-Vulnerable-Driver-Block-Lists/refs/heads/main/msft_vuln_driver_block_list.json

Telemetry coverage

Platform	Record / event type
Microsoft Defender for Endpoint	`DeviceEvents` action `DriverLoad`: Driver loaded
Microsoft Defender for Endpoint	`DeviceEvents` action `any`: Defender event
Microsoft Defender for Endpoint	`DeviceFileEvents` action `any`: File activity

Rule body

// Author: Cyb3rMonk(https://twitter.com/Cyb3rMonk, https://academy.bluraven.io)
//
// Query parameters:
let driver_block_list = externaldata (driver:dynamic) [@"https://raw.githubusercontent.com/Cyb3r-Monk/Microsoft-Vulnerable-Driver-Block-Lists/refs/heads/main/msft_vuln_driver_block_list.json"]
    with (format=multijson, ingestionMapping='[{"Column":"driver","Properties":{"Path":"$"}}]')
| evaluate bag_unpack(driver)
;
let driver_hashes = toscalar(
    driver_block_list
    | where isnotempty(FileHash)
    | summarize make_set(tolower(FileHash))
    )
;
union 
    (
        DeviceEvents
        | where ActionType == "DriverLoad"
        | where SHA1 in~ (driver_hashes) or SHA256 in~ (driver_hashes)
    ),
    (
        DeviceFileEvents
        | where SHA1 in~ (driver_hashes) or SHA256 in~ (driver_hashes)
    )

Stages and Predicates

Let binding: `driver_block_list`

let driver_block_list = externaldata (driver:dynamic) [@"https://raw.githubusercontent.com/Cyb3r-Monk/Microsoft-Vulnerable-Driver-Block-Lists/refs/heads/main/msft_vuln_driver_block_list.json"]
    with (format=multijson, ingestionMapping='[{"Column":"driver","Properties":{"Path":"$"}}]')
| evaluate bag_unpack(driver);

Let binding: `driver_hashes`

let driver_hashes = toscalar(
    driver_block_list
    | where isnotempty(FileHash)
    | summarize make_set(tolower(FileHash))
    );

union (2 sources)

Each leg below queries one source; the rule matches if any leg does. Sources: DeviceEvents, DeviceFileEvents

Leg 1: `DeviceEvents`

DeviceEvents
        | where ActionType == "DriverLoad"
        | where SHA1 in~ (driver_hashes) or SHA256 in~ (driver_hashes)

Leg 2: `DeviceFileEvents`

DeviceFileEvents
        | where SHA1 in~ (driver_hashes) or SHA256 in~ (driver_hashes)

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ActionType`	eq	`DriverLoad`	`field:"ActionType" kind:eq value:"DriverLoad"`
`SHA1`	in	`driver_hashes`	`field:"sha1" kind:in value:"driver_hashes"`
`SHA256`	in	`driver_hashes`	`field:"sha256" kind:in value:"driver_hashes"`