Detection rules › Splunk
Kernel Service Installed - Windows (Windows Event Log)
Adversaries may bring a signed vulnerable driver onto a compromised machine so that they can exploit the vulnerability to execute code in kernel mode. This process is sometimes referred to as Bring Your Own Vulnerable Driver (BYOVD). Adversaries may include the vulnerable driver with files delivered during Initial Access or download it to a compromised system via Ingress Tool Transfer or Lateral Tool Transfer. The use case detects Windows System Event ID 7045 with .sys file type.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence | T1543.003 Create or Modify System Process: Windows Service |
| Privilege Escalation | T1068 Exploitation for Privilege Escalation, T1543.003 Create or Modify System Process: Windows Service |
References
Event coverage
| Provider | Event |
|---|---|
| Service-Control-Manager | Event ID 7045 |
Rule body yaml
id: '30490.54568'
title: Kernel Service Installed - Windows
description: Adversaries may bring a signed vulnerable driver onto a compromised machine
so that they can exploit the vulnerability to execute code in kernel mode. This
process is sometimes referred to as Bring Your Own Vulnerable Driver (BYOVD). Adversaries
may include the vulnerable driver with files delivered during Initial Access or
download it to a compromised system via Ingress Tool Transfer or Lateral Tool Transfer.
The use case detects Windows System Event ID 7045 with .sys file type.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` ((EventCode=7045) OR ">7045</EventID>")
".sys" | table _time, host, user, signature_id, process_name, ServiceName, ServiceType,
ImagePath | bin span=1s | stats values(*) as * by _time, host '
techniques:
- persistence:create or modify system process:windows service
- privilege-escalation:exploitation for privilege escalation
technique_id:
- T1543.003
- T1068
data_category:
- Windows event logs
references:
- https://techcommunity.microsoft.com/t5/microsoft-security-experts-blog/strategies-to-monitor-and-prevent-vulnerable-driver-attacks/ba-p/4103985
- https://www.loldrivers.io/
- https://attack.mitre.org/techniques/T1068/
- https://attack.mitre.org/techniques/T1543/003/
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_winevent` ((EventCode=7045) OR ">7045</EventID>") ".sys"
Stage 2: table
| table _time, host, user, signature_id, process_name, ServiceName, ServiceType, ImagePath
Stage 3: bucket
| bin span=1s
Stage 4: stats
| stats values(*) as * by _time, host
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | ">7045</EventID>" |
| 1 | ".sys" |