Name:Windows Driver Load Non-Standard Path id:9216ef3d-066a-4958-8f27-c84589465e62 version:4 date:2024-10-17 author:Michael Haag, Splunk status:production type:TTP Description:The following analytic detects the loading of new Kernel Mode Drivers from non-standard paths using Windows EventCode 7045. It identifies drivers not located in typical directories like Windows, Program Files, or SystemRoot. This activity is significant because adversaries may use these non-standard paths to load malicious or vulnerable drivers, potentially bypassing security controls. If confirmed malicious, this could allow attackers to execute code at the kernel level, escalate privileges, or maintain persistence within the environment, posing a severe threat to system integrity and security. Data_source:
-Windows Event Log System 7045
search:`wineventlog_system` EventCode=7045 ServiceType="kernel mode driver" | regex ImagePath!="(?i)^(\w:\\\\Windows\\\\|\w:\\\\Program\sFile|\\\\systemroot\\\\|%SystemRoot%|system32\\\\)" | stats count min(_time) as firstTime max(_time) as lastTime by Computer EventCode ImagePath ServiceName ServiceType | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_driver_load_non_standard_path_filter`
how_to_implement:To implement this analytic, the Windows EventCode 7045 will need to be logged. The Windows TA for Splunk is also recommended. known_false_positives:False positives may be present based on legitimate third party applications needing to install drivers. Filter, or allow list known good drivers consistently being installed in these paths. References: -https://redcanary.com/blog/tracking-driver-inventory-to-expose-rootkits/ -https://attack.mitre.org/techniques/T1014/ -https://www.fuzzysecurity.com/tutorials/28.html drilldown_searches: name:'View the detection results for - "$dest$"' search:'%original_detection_search% | search dest = "$dest$"' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' name:'View risk events for the last 7 days for - "$dest$"' search:'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' tags: analytic_story: - 'Windows Drivers' - 'CISA AA22-320A' - 'AgentTesla' - 'BlackByte Ransomware' - 'BlackSuit Ransomware' asset_type:Endpoint confidence:60 impact:60 message:A kernel mode driver was loaded from a non-standard path on $dest$. mitre_attack_id: - 'T1014' - 'T1068' observable: name:'dest' type:'Endpoint' - role: - 'Victim' product: - 'Splunk Enterprise' - 'Splunk Enterprise Security' - 'Splunk Cloud' required_fields: - '_time' - 'Computer' - 'EventCode' - 'ImagePath' - 'ServiceName' - 'ServiceType' risk_score:36 security_domain:endpoint
