mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Bhavin Patel
73 lines
2.5 KiB
YAML
73 lines
2.5 KiB
YAML
name: Suspicious Driver Loaded Path
|
|
id: f880acd4-a8f1-11eb-a53b-acde48001122
|
|
version: 1
|
|
date: '2021-04-29'
|
|
author: Teoderick Contreras, Splunk
|
|
type: TTP
|
|
datamodel:
|
|
- Endpoint
|
|
description: This analytic will detect suspicious driver loaded paths. This technique
|
|
is commonly used by malicious software like coin miners (xmrig) to register its
|
|
malicious driver from notable directories where executable or drivers do not commonly
|
|
exist. During triage, validate this driver is for legitimate business use. Review
|
|
the metadata and certificate information. Unsigned drivers from non-standard paths
|
|
is not normal, but occurs. In addition, review driver loads into `ntoskrnl.exe`
|
|
for possible other drivers of interest. Long tail analyze drivers by path (outside
|
|
of default, and in default) for further review.
|
|
search: '`sysmon` EventCode=6 ImageLoaded = "*.sys" NOT (ImageLoaded IN("*\\WINDOWS\\inf","*\\WINDOWS\\System32\\drivers\\*",
|
|
"*\\WINDOWS\\System32\\DriverStore\\FileRepository\\*")) | stats min(_time) as
|
|
firstTime max(_time) as lastTime count by Computer ImageLoaded Hashes IMPHASH Signature
|
|
Signed | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
|
|
| `suspicious_driver_loaded_path_filter`'
|
|
how_to_implement: To successfully implement this search, you need to be ingesting
|
|
logs with the driver loaded and Signature from your endpoints. If you are using
|
|
Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
|
|
known_false_positives: Limited false positives will be present. Some applications
|
|
do load drivers
|
|
references:
|
|
- https://www.trendmicro.com/vinfo/hk/threat-encyclopedia/malware/trojan.ps1.powtran.a/
|
|
- https://redcanary.com/blog/tracking-driver-inventory-to-expose-rootkits/
|
|
tags:
|
|
analytic_story:
|
|
- XMRig
|
|
- CISA AA22-320A
|
|
- AgentTesla
|
|
confidence: 90
|
|
context:
|
|
- Source:Endpoint
|
|
- Stage:Execution
|
|
- Stage:Defense Evasion
|
|
dataset:
|
|
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log
|
|
impact: 70
|
|
kill_chain_phases:
|
|
- Exploitation
|
|
message: Suspicious driver $ImageLoaded$ on $Computer$
|
|
mitre_attack_id:
|
|
- T1543.003
|
|
- T1543
|
|
observable:
|
|
- name: Computer
|
|
type: Endpoint
|
|
role:
|
|
- Victim
|
|
- name: ImageLoaded
|
|
type: File Name
|
|
role:
|
|
- Attacker
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
required_fields:
|
|
- _time
|
|
- Computer
|
|
- ImageLoaded
|
|
- Hashes
|
|
- IMPHASH
|
|
- Signature
|
|
- Signed
|
|
risk_score: 63
|
|
security_domain: endpoint
|
|
asset_type: Endpoint
|