New Kernel Driver Via SC.EXE

Title: New Kernel Driver Via SC.EXE
Status: test
Description:Detects creation of a new service (kernel driver) with the type "kernel"
References:
  -https://www.aon.com/cyber-solutions/aon_cyber_labs/yours-truly-signed-av-driver-weaponizing-an-antivirus-driver/
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-07-14
modified:2025-10-07
Tags:

• -'attack.persistence'
• -'attack.privilege-escalation'
• -'attack.t1543.003'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    Image|endswith: '\sc.exe'
    CommandLine|contains:
      -'create'
      -'config'

    CommandLine|contains|all:
      -'binPath'
      -'type'
      -'kernel'

  filter_optional_avira_driver:
    - CommandLine|contains|all:
      - 'create netprotection_network_filter'
      - 'type= kernel start= '
      - 'binPath= System32\drivers\netprotection_network_filter'
      - 'DisplayName= netprotection_network_filter'
      - 'group= PNP_TDI tag= yes'
    - CommandLine|contains|all:
      - 'create avelam binpath=C:\Windows\system32\drivers\avelam.sys'
      - 'type=kernel start=boot error=critical group=Early-Launch'
  condition:selection and not 1 of filter_optional_*
Falsepositives:
  -Rare legitimate installation of kernel drivers via sc.exe
Level: medium