UEFI Persistence Via Wpbbin - FileCreation

Title: UEFI Persistence Via Wpbbin - FileCreation
Status: test
Description:Detects creation of a file named "wpbbin" in the "%systemroot%\system32\" directory. Which could be indicative of UEFI based persistence method
References:
  -https://grzegorztworek.medium.com/using-uefi-to-inject-executable-files-into-bitlocker-protected-drives-8ff4ca59c94c
  -https://persistence-info.github.io/Data/wpbbin.html
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-07-18
modified:None
Tags:

• -'attack.persistence'
• -'attack.stealth'
• -'attack.t1542.001'

Logsource:

• product: windows
• category: file_event

Detection:
  selection:
    TargetFilename: 'C:\Windows\System32\wpbbin.exe'
  condition:selection
Falsepositives:
  -Legitimate usage of the file by hardware manufacturer such as lenovo (Thanks @0gtweet for the tip)
Level: high