Detection rules › Splunk
Driver Loaded from Unusual Path - Windows (Sysmon)
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Adversaries may also use services to install and execute malicious drivers. For example, after dropping a driver file (ex: .sys) to disk, the payload can be loaded and registered via Native API functions. This use case detects Driver loaded events excluding expected paths Windows\System32\drivers, Windows\SysWOW64\drivers, Windows\INF, and Windows\System32\DriverStore.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence | T1543.003 Create or Modify System Process: Windows Service |
| Privilege Escalation | T1068 Exploitation for Privilege Escalation, T1543.003 Create or Modify System Process: Windows Service |
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 6 | Driver loaded |
Rule body yaml
id: '30731.54883'
title: Driver Loaded from Unusual Path - Windows
description: 'Adversaries may exploit software vulnerabilities in an attempt to elevate
privileges. Exploitation of a software vulnerability occurs when an adversary takes
advantage of a programming error in a program, service, or within the operating
system software or kernel itself to execute adversary-controlled code. Adversaries
may also use services to install and execute malicious drivers. For example, after
dropping a driver file (ex: .sys) to disk, the payload can be loaded and registered
via Native API functions. This use case detects Driver loaded events excluding expected
paths Windows\System32\drivers, Windows\SysWOW64\drivers, Windows\INF, and Windows\System32\DriverStore.'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=6) OR "<EventID>6<")
| regex ImageLoaded!="(?i)\x5cWindows\x5c((System32|sysWOW64)\x5cDrivers(tore)?)|inf"
| table _time, host, user, ImageLoaded, signature_id, process_name | bin span=1s
| stats values(*) as * by _time, host '
techniques:
- persistence:create or modify system process:windows service
- privilege-escalation:exploitation for privilege escalation
technique_id:
- T1543.003
- T1068
data_category:
- Windows Sysmon
references:
- https://attack.mitre.org/techniques/T1068/
- https://attack.mitre.org/techniques/T1543/003/
- https://techcommunity.microsoft.com/t5/microsoft-security-experts-blog/strategies-to-monitor-and-prevent-vulnerable-driver-attacks/ba-p/4103985
- https://www.loldrivers.io/
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=6) OR "<EventID>6<")
Stage 2: regex
| regex ImageLoaded!="(?i)\x5cWindows\x5c((System32|sysWOW64)\x5cDrivers(tore)?)|inf"
Stage 3: table
| table _time, host, user, ImageLoaded, signature_id, process_name
Stage 4: bucket
| bin span=1s
Stage 5: stats
| stats values(*) as * by _time, host
Exclusions
Top-level NOT(...) conjuncts: predicates this rule actively suppresses.
| Field | Kind | Excluded values |
|---|---|---|
ImageLoaded | regex_match | "(?i)\x5cWindows\x5c((System32|sysWOW64)\x5cDrivers(tore)?), inf" |
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | "<EventID>6<" |