Driver as Command Parameter (Windows Event Log)

id: '6129.6614'
title: Driver as Command Parameter
description: 'Adversaries may use signed drivers in order to take advantage of vulnerabilities
  in order to execute malicious code or establish persistence. This use case looks
  for when a driver file (.sys) has been passed as a command line parameter. -- Threat
  Actor Association: Bluebottle, Lancefly, Lazarus - Software Association: Cuba, DirtyMoe,
  HermeticWiper - Atomics T1014 Test #3'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) "sys" | regex process="(?i)\.sys"| table _time,
  host, user, signature_id, process, process_*, parent_process_* | bin span=1s | stats
  values(*) as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution
- privilege-escalation:exploitation for privilege escalation
technique_id: 
- T1218
- T1068
data_category:
- Windows event logs
- Process command-line parameters
references:
- https://zerosum0x0.blogspot.com/2017/07/puppet-strings-dirty-secret-for-free.html
- http://www.fuzzysecurity.com/tutorials/28.html