Try in Splunk Security Cloud

Description

The following analytic utilizes a known list of vulnerable Windows drivers to help defenders find potential persistence or privelege escalation via a vulnerable driver. This analytic uses Sysmon EventCode 6, driver loading. A known gap with this lookup is that it does not use the hash or known signer of the vulnerable driver therefore it is up to the defender to identify version and signing info and confirm it is a vulnerable driver.

  • Type: Hunting
  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud

  • Last Updated: 2022-12-12
  • Author: Michael Haag, Splunk
  • ID: a2b1f1ef-221f-4187-b2a4-d4b08ec745f4

Annotations

ATT&CK

ATT&CK

ID Technique Tactic
T1543.003 Windows Service Persistence, Privilege Escalation
Kill Chain Phase
  • Exploitation
NIST
  • DE.CM
CIS20
  • CIS 3
  • CIS 5
  • CIS 16
CVE
1
2
3
4
5
6
7
`sysmon` EventCode=6 
| lookup loldrivers driver_name AS ImageLoaded OUTPUT is_driver driver_description 
| search is_driver = TRUE 
| stats  min(_time) as firstTime max(_time) as lastTime count by dest ImageLoaded driver_description 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `windows_loading_known_vulnerable_driver_filter`

Macros

The SPL above uses the following Macros:

:information_source: windows_vulnerable_driver_loaded_filter is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Lookups

The SPL above uses the following Lookups:

Required fields

List of fields required to use this analytic.

  • _time
  • dest
  • ImageLoaded

How To Implement

Sysmon collects driver loads via EventID 6, however you may modify the query to utilize this lookup to identify potentially persistent drivers that are known to be vulnerable.

Known False Positives

False positives will be present. Drill down into the driver further by version number and cross reference by signer. Review the reference material in the lookup. In addition, modify the query to look within specific paths, which will remove a lot of "normal" drivers.

Associated Analytic Story

RBA

Risk Score Impact Confidence Message
25.0 50 50 An process has loaded a possible vulnerable driver on $dest$. Review and escalate as needed.

:information_source: The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.

Reference

Test Dataset

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

source | version: 1