Detection rules › Sigma

New Kernel Driver Via SC.EXE

Status
test
Severity
medium
Log source
category process_creation, product windows
Author
Nasreddine Bencherchali (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects creation of a new service (kernel driver) with the type "kernel"

Known false positives

  • Rare legitimate installation of kernel drivers via sc.exe

MITRE ATT&CK coverage

Telemetry coverage

Rule body

title: New Kernel Driver Via SC.EXE
id: 431a1fdb-4799-4f3b-91c3-a683b003fc49
status: test
description: Detects creation of a new service (kernel driver) with the type "kernel"
references:
    - https://www.aon.com/cyber-solutions/aon_cyber_labs/yours-truly-signed-av-driver-weaponizing-an-antivirus-driver/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-07-14
modified: 2025-10-07
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.t1543.003
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\sc.exe'
        CommandLine|contains:
            - 'create'
            - 'config'
        CommandLine|contains|all:
            - 'binPath'
            - 'type'
            - 'kernel'
    filter_optional_avira_driver:
        - CommandLine|contains|all:
              - 'create netprotection_network_filter'
              - 'type= kernel start= '
              - 'binPath= System32\drivers\netprotection_network_filter'
              - 'DisplayName= netprotection_network_filter'
              - 'group= PNP_TDI tag= yes'
        - CommandLine|contains|all:
              - 'create avelam binpath=C:\Windows\system32\drivers\avelam.sys'
              - 'type=kernel start=boot error=critical group=Early-Launch'
    condition: selection and not 1 of filter_optional_*
falsepositives:
    - Rare legitimate installation of kernel drivers via sc.exe
level: medium

Stages and Predicates

Stage 0: condition

selection and not 1 of filter_optional_*

Stage 1: selection

selection:
    Image|endswith: '\sc.exe'
    CommandLine|contains:
        - 'create'
        - 'config'
    CommandLine|contains|all:
        - 'binPath'
        - 'type'
        - 'kernel'

Stage 2: not filter_optional_avira_driver

filter_optional_avira_driver:
    - CommandLine|contains|all:
          - 'create netprotection_network_filter'
          - 'type= kernel start= '
          - 'binPath= System32\drivers\netprotection_network_filter'
          - 'DisplayName= netprotection_network_filter'
          - 'group= PNP_TDI tag= yes'
    - CommandLine|contains|all:
          - 'create avelam binpath=C:\Windows\system32\drivers\avelam.sys'
          - 'type=kernel start=boot error=critical group=Early-Launch'

Exclusions

The rule actively suppresses these predicates.

FieldKindExcluded valuesSearch
CommandLinematchDisplayName= netprotection_network_filterexcludes:CommandLine field:"CommandLine" value:"DisplayName= netprotection_network_filter"
CommandLinematchbinPath= System32\drivers\netprotection_network_filterexcludes:CommandLine field:"CommandLine" value:"binPath= System32\drivers\netprotection_network_filter"
CommandLinematchcreate netprotection_network_filterexcludes:CommandLine field:"CommandLine" value:"create netprotection_network_filter"
CommandLinematchgroup= PNP_TDI tag= yesexcludes:CommandLine field:"CommandLine" value:"group= PNP_TDI tag= yes"
CommandLinematchtype= kernel start= excludes:CommandLine field:"CommandLine" value:"type= kernel start= "
CommandLinematchcreate avelam binpath=C:\Windows\system32\drivers\avelam.sysexcludes:CommandLine field:"CommandLine" value:"create avelam binpath=C:\Windows\system32\drivers\avelam.sys"
CommandLinematchtype=kernel start=boot error=critical group=Early-Launchexcludes:CommandLine field:"CommandLine" value:"type=kernel start=boot error=critical group=Early-Launch"

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
CommandLinematch
  • binPath corpus 6 (sigma 5, splunk 1)
  • config corpus 16 (sigma 15, splunk 1)
  • create corpus 29 (sigma 17, splunk 7, elastic 5)
  • kernel
  • type corpus 3 (sigma 2, splunk 1)
field:"CommandLine" kind:match
Imageends_with
  • \sc.exe corpus 30 (sigma 30)
field:"Image" kind:ends_with value:"\sc.exe"