Detection rules › Kusto
Detect LolDriver drop or load from unknown or unsigned process
Adversaries may use LolDrivers to elevate their privileges on a system. Regularly, their drop their own LolDrivers from their beacon process when the LolDriver is not yet present on the system. This is a detection use case to detect an unknown process dropping these LolDrivers.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Privilege Escalation |
References
Telemetry coverage
Rule body
let LOLDrivers = externaldata(Category:string, KnownVulnerableSamples:dynamic, Verified:string ) [h@"https://www.loldrivers.io/api/drivers.json"]
with (
format=multijson,
ingestionMapping=@'[{"Column":"Category","Properties":{"Path":"$.Category"}},{"Column":"KnownVulnerableSamples","Properties":{"Path":"$.KnownVulnerableSamples"}},{"Column":"Verified","Properties":{"Path":"$.Verified"}}]'
)
| mv-expand KnownVulnerableSamples
| extend SHA1 = tostring(KnownVulnerableSamples.SHA1), SHA256 = tostring(KnownVulnerableSamples.SHA256)
;
let SHA1List = toscalar(
LOLDrivers
| summarize make_set(SHA1)
);
let SHA256List = toscalar(
LOLDrivers
| summarize make_set(SHA256)
);
let device_events = (
DeviceEvents
| where Timestamp > ago(1h)
| where ActionType == "DriverLoaded"
| where SHA1 in ( SHA1List ) or SHA256 in ( SHA256List )
);
let device_file_events = (
DeviceFileEvents
| where Timestamp > ago(1h)
| where ActionType == "FileCreated"
| where SHA1 in ( SHA1List ) or SHA256 in ( SHA256List )
);
union device_events, device_file_events
| invoke FileProfile(InitiatingProcessSHA1)
| where GlobalPrevalence < 1000 or SignatureState =~ "Unsigned"
Stages and Predicates
Stage 0: let
let LOLDrivers = externaldata(Category:string, KnownVulnerableSamples:dynamic, Verified:string ) [h@"https://www.loldrivers.io/api/drivers.json"]
with (
format=multijson,
ingestionMapping=@'[{"Column":"Category","Properties":{"Path":"$.Category"}},{"Column":"KnownVulnerableSamples","Properties":{"Path":"$.KnownVulnerableSamples"}},{"Column":"Verified","Properties":{"Path":"$.Verified"}}]'
)
| mv-expand KnownVulnerableSamples
| extend SHA1 = tostring(KnownVulnerableSamples.SHA1), SHA256 = tostring(KnownVulnerableSamples.SHA256)
;
let SHA1List = toscalar(
LOLDrivers
| summarize make_set(SHA1)
);
let SHA256List = toscalar(
LOLDrivers
| summarize make_set(SHA256)
);
let device_events = ( <inlined as stages below>;
let device_file_events = ( <inlined as stages below>;
Stage 1: source
let device_events
Stage 2: source
let device_file_events
Stage 3: union
union of 2 branches
Stage 4: source
DeviceEvents
Stage 5: where
where Timestamp > ago(3600s)
Stage 6: where
where ActionType =~ "DriverLoaded"
Stage 7: where
where (SHA1 =~ "SHA1List" or SHA256 =~ "SHA256List")
Stage 8: source
DeviceFileEvents
Stage 9: where
where Timestamp > ago(3600s)
Stage 10: where
where ActionType =~ "FileCreated"
Stage 11: where
where (SHA1 =~ "SHA1List" or SHA256 =~ "SHA256List")
Stage 12: invoke
invoke
Stage 13: where
where (GlobalPrevalence < 1000 or SignatureState =~ "Unsigned")
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
ActionType | eq |
| field:"ActionType" kind:eq |
GlobalPrevalence | lt |
| field:"GlobalPrevalence" kind:lt value:"1000" |
SHA1 | in |
| field:"sha1" kind:in value:"SHA1List" |
SHA256 | in |
| field:"sha256" kind:in value:"SHA256List" |
SignatureState | eq |
| field:"SignatureState" kind:eq value:"Unsigned" |