name: Windows System File on Disk
id: 993ce99d-9cdd-42c7-a2cf-733d5954e5a6
version: 2
date: '2022-05-16'
author: Michael Haag, Splunk
status: production
type: Hunting
description: The following hunting analytic will assist with identifying new .sys
  files introduced in the environment. This query is meant to identify sys file creates
  on disk. There will be noise, but reducing common process names or applications
  should help to limit any volume. The idea is to identify new sys files written to
  disk and identify them before they're added as a new kernel mode driver.
data_source:
- Sysmon Event ID 11
search:
  selection1:
    Filesystem.file_name: '*.sys*'
  condition: selection1
how_to_implement: To successfully implement this search you need to be ingesting information
  on files from your endpoints into the `Endpoint` datamodel in the `Filesystem` node.
  In addition, confirm the latest CIM App 4.20 or higher is installed and the latest
  TA for the endpoint product. In addition, filtering may occur by adding NOT (Filesystem.file_path
  IN ("*\\Windows\\*", "*\\Program File*", "*\\systemroot\\*","%SystemRoot%*", "system32\*")).
  This will level out the noise generated to potentally lead to generating notables.
known_false_positives: False positives will be present. Filter as needed.
references:
- https://redcanary.com/blog/tracking-driver-inventory-to-expose-rootkits/
tags:
  analytic_story:
  - Windows Drivers
  - CISA AA22-264A
  asset_type: Endpoint
  confidence: 50
  impact: 20
  message: A new driver is present on $dest$.
  mitre_attack_id:
  - T1068
  observable:
  - name: dest
    type: Hostname
    role:
    - Victim
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  risk_score: 10
  security_domain: endpoint
tests:
- name: True Positive Test
  attack_data:
  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/drivers/sysmon_sys_filemod.log
    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
    sourcetype: xmlwineventlog
    update_timestamp: true