ID | Technique | Tactic |
---|---|---|
T1068 | Exploitation for Privilege Escalation | Privilege Escalation |
Detection: Windows Driver Inventory
EXPERIMENTAL DETECTION
This detection status is set to experimental. The Splunk Threat Research team has not yet fully tested, simulated, or built comprehensive datasets for this detection. As such, this analytic is not officially supported. If you have any questions or concerns, please reach out to us at research@splunk.com.
Description
The following analytic identifies drivers being loaded across the fleet. It leverages a PowerShell script input deployed to critical systems to capture driver data. This detection is significant as it helps monitor for unauthorized or malicious drivers that could compromise system integrity. If confirmed malicious, such drivers could allow attackers to execute arbitrary code, escalate privileges, or maintain persistence within the environment.
Search
1`driverinventory`
2| stats values(Path) min(_time) as firstTime max(_time) as lastTime count by host DriverType
3| rename host as dest
4| `security_content_ctime(firstTime)`
5| `security_content_ctime(lastTime)`
6| `windows_driver_inventory_filter`
Data Source
Name | Platform | Sourcetype | Source | Supported App |
---|---|---|---|---|
N/A | N/A | N/A | N/A | N/A |
Macros Used
Name | Value |
---|---|
driverinventory | sourcetype=PwSh:DriverInventory |
windows_driver_inventory_filter | search * |
windows_driver_inventory_filter
is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Annotations
Default Configuration
This detection is configured by default in Splunk Enterprise Security to run with the following settings:
Setting | Value |
---|---|
Disabled | true |
Cron Schedule | 0 * * * * |
Earliest Time | -70m@m |
Latest Time | -10m@m |
Schedule Window | auto |
Creates Risk Event | False |
Implementation
To capture the drivers by host, utilize the referenced Gist to create the inputs, props and transforms. Otherwise, this hunt query will not work.
Known False Positives
Filter and modify the analytic as you'd like. Filter based on path. Remove the system32\drivers and look for non-standard paths.
Associated Analytic Story
Risk Based Analytics (RBA)
Risk Message | Risk Score | Impact | Confidence |
---|---|---|---|
Drivers have been identified on $dest$. | 5 | 50 | 10 |
References
Detection Testing
Test Type | Status | Dataset | Source | Sourcetype |
---|---|---|---|---|
Validation | Not Applicable | N/A | N/A | N/A |
Unit | ✅ Passing | Dataset | PwSh:DriverInventory |
PwSh:DriverInventory |
Integration | ✅ Passing | Dataset | PwSh:DriverInventory |
PwSh:DriverInventory |
Replay any dataset to Splunk Enterprise by using our replay.py
tool or the UI.
Alternatively you can replay a dataset into a Splunk Attack Range
Source: GitHub | Version: 2