Windows Vulnerable Driver Installed

Try in Splunk Security Cloud

Description

The following analytic detects the loading of known vulnerable Windows drivers, which may indicate potential persistence or privilege escalation attempts. It leverages Windows System service install EventCode 7045 to identify driver loading events and cross-references them with a list of vulnerable drivers. This activity is significant as attackers often exploit vulnerable drivers to gain elevated privileges or maintain persistence on a system. If confirmed malicious, this could allow attackers to execute arbitrary code with high privileges, leading to further system compromise and potential data exfiltration. This detection is a Windows Event Log adaptation of the Sysmon driver loaded detection written by Michael Haag.

• Type: TTP

• Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud

• Last Updated: 2024-08-07
• Author: Dean Luxton
• ID: 1dda7586-57be-4a1b-8de1-a9ad802b9a7f

Annotations

ATT&CK

ATT&CK

ID	Technique	Tactic
T1543.003	Windows Service	Persistence, Privilege Escalation

Kill Chain Phase

• Installation
• Exploitation

NIST

• DE.CM

CIS20

• CIS 10

CVE

Search

`wineventlog_system` EventCode=7045 ServiceType="kernel mode driver" 
| table _time dest EventCode ImagePath ServiceName ServiceType 
| lookup loldrivers driver_name AS ImagePath OUTPUT is_driver driver_description 
| search is_driver = TRUE  
| `windows_vulnerable_driver_installed_filter`

Macros

The SPL above uses the following Macros:

• wineventlog_system

windows_vulnerable_driver_installed_filter is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Lookups

The SPL above uses the following Lookups:

• loldrivers with data

Required fields

List of fields required to use this analytic.

• ServiceType
• driver_name

How To Implement

Ensure the Splunk is collecting XmlWinEventLog:System events and the EventCode 7045 is being ingested.

Known False Positives

False positives will be present. Drill down into the driver further by version number and cross reference by signer. Review the reference material in the lookup. In addition, modify the query to look within specific paths, which will remove a lot of "normal" drivers.

Associated Analytic Story

• Windows Drivers

RBA

Risk Score	Impact	Confidence	Message
50.0	100	50	Potentially vulnerable/malicious driver [$ImagePath$] has been installed on $dest$

The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.

Reference

• https://loldrivers.io/
• https://github.com/SpikySabra/Kernel-Cactus
• https://github.com/wavestone-cdt/EDRSandblast
• https://research.splunk.com/endpoint/a2b1f1ef-221f-4187-b2a4-d4b08ec745f4/
• https://www.splunk.com/en_us/blog/security/these-are-the-drivers-you-are-looking-for-detect-and-prevent-malicious-drivers.html

Test Dataset

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

source | version: 2