Elastic Defend high stable eql

Kernel Driver Registered via NtLoadDriver

Adversaries may load a driver to a compromised machine to execute code in kernel mode. A majority of legitimate kernel driver installations involve a new service creation via the Windows Service Control Manager (SCM) which generate audit logs. Adversaries can leverage the undocumented Windows API NtLoadDriver to load a driver directly, avoiding service creation traces.

View Source

Detection Logic

sequence by process.entity_id with maxspan=5m
 [process where event.action == "start" and 
  (process.code_signature.trusted == false or process.code_signature.exists == false) and 
  (process.Ext.relative_file_creation_time <= 3600 or process.Ext.relative_file_name_modify_time <= 500)]
 [registry where
  registry.path : "HKLM\\SYSTEM\\ControlSet001\\*\\Type" and registry.data.strings : "1"]

Field Validations

Loading…

Comments (0)

Loading comments...