mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Bhavin Patel
54 lines
2.1 KiB
YAML
54 lines
2.1 KiB
YAML
name: Windows BootLoader Inventory
|
|
id: 4f7e3913-4db3-4ccd-afe4-31198982305d
|
|
version: 2
|
|
date: '2024-05-15'
|
|
author: Michael Haag, Splunk
|
|
status: experimental
|
|
type: Hunting
|
|
data_source: []
|
|
description: The following analytic identifies the bootloader paths on Windows endpoints.
|
|
It leverages a PowerShell Scripted input to capture this data, which is then processed
|
|
and aggregated using Splunk. Monitoring bootloader paths is significant for a SOC
|
|
as it helps detect unauthorized modifications that could indicate bootkits or other
|
|
persistent threats. If confirmed malicious, such activity could allow attackers
|
|
to maintain persistence, bypass security controls, and potentially control the boot
|
|
process, leading to full system compromise.
|
|
search: '`bootloader_inventory` | stats count min(_time) as firstTime max(_time) as
|
|
lastTime values(_raw) by host | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
|
|
| `windows_bootloader_inventory_filter`'
|
|
how_to_implement: To implement this analytic, a new stanza will need to be added to
|
|
a inputs.conf and deployed to all or some Windows endpoints. https://gist.github.com/MHaggis/26518cd2844b0e03de6126660bb45707
|
|
provides the stanza. If modifying the sourcetype, be sure to update the Macro for
|
|
this analytic. Recommend running it daily, or weekly, depending on threat model.
|
|
known_false_positives: No false positives here, only bootloaders. Filter as needed
|
|
or create a lookup as a baseline.
|
|
references:
|
|
- https://gist.github.com/MHaggis/26518cd2844b0e03de6126660bb45707
|
|
- https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/
|
|
tags:
|
|
analytic_story:
|
|
- BlackLotus Campaign
|
|
- Windows BootKits
|
|
asset_type: Endpoint
|
|
atomic_guid: []
|
|
confidence: 90
|
|
impact: 90
|
|
message: A list of BootLoaders are present on $dest$
|
|
mitre_attack_id:
|
|
- T1542.001
|
|
- T1542
|
|
observable:
|
|
- name: host
|
|
type: Endpoint
|
|
role:
|
|
- Victim
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
required_fields:
|
|
- _time
|
|
- _raw
|
|
risk_score: 81
|
|
security_domain: endpoint
|