Windows Vulnerable Driver Loaded

THIS IS A EXPERIMENTAL DETECTION

This detection has been marked experimental by the Splunk Threat Research team. This means we have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is NOT supported.

Try in Splunk Security Cloud

Description

The following analytic utilizes a known list of vulnerable Windows drivers to help defenders find potential persistence or privelege escalation via a vulnerable driver. This analytic uses Sysmon EventCode 6, driver loading. A known gap with this lookup is that it does not use the hash or known signer of the vulnerable driver therefore it is up to the defender to identify version and signing info and confirm it is a vulnerable driver.

• Type: Hunting

• Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud

• Last Updated: 2022-12-12
• Author: Michael Haag, Splunk
• ID: a2b1f1ef-221f-4187-b2a4-d4b08ec745f4

Annotations

ATT&CK

ATT&CK

ID	Technique	Tactic
T1543.003	Windows Service	Persistence, Privilege Escalation

Kill Chain Phase

• Installation
• Exploitation

NIST

• DE.AE

CIS20

• CIS 10

CVE

Search

`sysmon` EventCode=6 
| lookup loldrivers driver_name AS ImageLoaded OUTPUT is_driver driver_description 
| search is_driver = TRUE 
| stats  min(_time) as firstTime max(_time) as lastTime count by dest ImageLoaded driver_description 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `windows_vulnerable_driver_loaded_filter`

Macros

The SPL above uses the following Macros:

• security_content_ctime
• sysmon

windows_vulnerable_driver_loaded_filter is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Lookups

The SPL above uses the following Lookups:

• loldrivers with data

Required fields

List of fields required to use this analytic.

• _time
• dest
• ImageLoaded

How To Implement

Sysmon collects driver loads via EventID 6, however you may modify the query to utilize this lookup to identify potentially persistent drivers that are known to be vulnerable.

Known False Positives

False positives will be present. Drill down into the driver further by version number and cross reference by signer. Review the reference material in the lookup. In addition, modify the query to look within specific paths, which will remove a lot of "normal" drivers.

Associated Analytic Story

• Windows Drivers
• BlackByte Ransomware

RBA

Risk Score	Impact	Confidence	Message
25.0	50	50	An process has loaded a possible vulnerable driver on $dest$. Review and escalate as needed.

The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.

Reference

• https://github.com/SigmaHQ/sigma/blob/master/rules/windows/driver_load/driver_load_vuln_drivers_names.yml
• https://github.com/eclypsium/Screwed-Drivers/blob/master/DRIVERS.md
• https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules
• https://www.rapid7.com/blog/post/2021/12/13/driver-based-attacks-past-and-present/
• https://github.com/jbaines-r7/dellicious
• https://github.com/MicrosoftDocs/windows-itpro-docs/blob/public/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md
• https://github.com/namazso/physmem_drivers
• https://github.com/stong/CVE-2020-15368
• https://github.com/CaledoniaProject/drivers-binaries
• https://github.com/Chigusa0w0/AsusDriversPrivEscala
• https://www.welivesecurity.com/2022/01/11/signed-kernel-drivers-unguarded-gateway-windows-core/
• https://eclypsium.com/2019/11/12/mother-of-all-drivers/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-37969

Test Dataset

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

source | version: 1