detection.wiki

Detection rules › Kusto

Suspicious Driver Load

Group by
SHA1
Author
Cyb3rMonk
Source
github.com/Cyb3r-Monk/Threat-Hunting-and-Detection

Below query detects suspicious(unusual/rare) driver loads. Further checks are required on detected files to confirm malicious activity.

MITRE ATT&CK coverage

TacticTechniques
StealthNo specific technique

Event coverage

ProviderEvent/ActionTypeTitle
SysmonEvent ID 6Driver loaded
Defender-DeviceEventsDriverLoadDriver loaded
Threat-IntelligenceEvent ID 30Driver Load

Rule body kusto

// Author: Cyb3rMonk(https://twitter.com/Cyb3rMonk, https://mergene.medium.com)
// Link to blog post:
// https://posts.bluraven.io/detecting-edr-bypass-malicious-drivers-kernel-callbacks-f5e6bf8f7481
//
// Query parameters:
// Query at least 7d of data to reduce false positives(if you have many.
DeviceEvents
| where ActionType == "DriverLoad"
| distinct SHA1 // get SHA1 of the drivers
// get certificate information of the drivers
| join kind=inner
    (
    DeviceFileCertificateInfo
    // get only the files having certificate older than "7/30/2015" 
    | where CertificateCreationTime < todatetime("7/30/2015") or CertificateExpirationTime < todatetime("7/30/2015")
    ) on SHA1
    // use prevalence. assuming malicious driver has been installed on max 5 machines.
    | summarize dcount(DeviceId) by SHA1
    | where dcount_DeviceId <= 5
    // get file profile 
    | invoke FileProfile(SHA1,1000)
    // filter out the files having GlobalPrevalence > 500 (FP reduction)
    | where GlobalPrevalence <= 500
    // get certificate details back
    | join DeviceFileCertificateInfo on SHA1

Stages and Predicates

Stage 1: source

DeviceEvents

Stage 2: where

| where ActionType == "DriverLoad"

Stage 3: distinct

| distinct SHA1

Stage 4: join

| join kind=inner
    (
    DeviceFileCertificateInfo
    | where CertificateCreationTime < todatetime("7/30/2015") or CertificateExpirationTime < todatetime("7/30/2015")
    ) on SHA1

Stage 5: summarize

| summarize dcount(DeviceId) by SHA1

Stage 6: where

| where dcount_DeviceId <= 5

Stage 7: invoke

| invoke FileProfile(SHA1,1000)

Stage 8: where

| where GlobalPrevalence <= 500

Stage 9: join

| join DeviceFileCertificateInfo on SHA1

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
ActionTypeeq
  • DriverLoad transforms: cased corpus 2 (kusto 2)
GlobalPrevalencele
  • 500 transforms: cased
dcount_DeviceIdle
  • 5 transforms: cased corpus 2 (kusto 2)

Output fields

Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.

FieldSource
SHA1summarize