Detection rules › Kusto
Suspicious Driver Load
Below query detects suspicious(unusual/rare) driver loads. Further checks are required on detected files to confirm malicious activity.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Stealth | No specific technique |
Telemetry coverage
Rule body
// Author: Cyb3rMonk(https://twitter.com/Cyb3rMonk, https://mergene.medium.com)
// Link to blog post:
// https://posts.bluraven.io/detecting-edr-bypass-malicious-drivers-kernel-callbacks-f5e6bf8f7481
//
// Query parameters:
// Query at least 7d of data to reduce false positives(if you have many.
DeviceEvents
| where ActionType == "DriverLoad"
| distinct SHA1 // get SHA1 of the drivers
// get certificate information of the drivers
| join kind=inner
(
DeviceFileCertificateInfo
// get only the files having certificate older than "7/30/2015"
| where CertificateCreationTime < todatetime("7/30/2015") or CertificateExpirationTime < todatetime("7/30/2015")
) on SHA1
// use prevalence. assuming malicious driver has been installed on max 5 machines.
| summarize dcount(DeviceId) by SHA1
| where dcount_DeviceId <= 5
// get file profile
| invoke FileProfile(SHA1,1000)
// filter out the files having GlobalPrevalence > 500 (FP reduction)
| where GlobalPrevalence <= 500
// get certificate details back
| join DeviceFileCertificateInfo on SHA1
Stages and Predicates
Stage 1: source
DeviceEvents
Stage 2: where
| where ActionType == "DriverLoad"
Stage 3: distinct
| distinct SHA1
Stage 4: join
| join kind=inner
(
DeviceFileCertificateInfo
| where CertificateCreationTime < todatetime("7/30/2015") or CertificateExpirationTime < todatetime("7/30/2015")
) on SHA1
Stage 5: summarize
| summarize dcount(DeviceId) by SHA1
Stage 6: where
| where dcount_DeviceId <= 5
Stage 7: invoke
| invoke FileProfile(SHA1,1000)
Stage 8: where
| where GlobalPrevalence <= 500
Stage 9: join
| join DeviceFileCertificateInfo on SHA1
Indicators
These rows show field, operator, and value matches.
Output fields
These fields are emitted when the rule matches.
| Field | Source |
|---|---|
SHA1 | summarize |