Detection rules › Sigma

New Kernel Driver Via SC.EXE

Severity
medium
Author
Nasreddine Bencherchali (Nextron Systems)
Source
upstream

Detects creation of a new service (kernel driver) with the type "kernel"

MITRE ATT&CK coverage

TacticTechniques
PersistenceT1543.003 Create or Modify System Process: Windows Service
Privilege EscalationT1543.003 Create or Modify System Process: Windows Service

Event coverage

ProviderEvent IDTitle
Sysmon1Process creation
Security-Auditing4688A new process has been created.

Stages and Predicates

Stage 1: selection

or:
CommandLine|contains: config
CommandLine|contains: create
CommandLine|contains: binPath
CommandLine|contains: kernel
CommandLine|contains: type
Image|endswith: '\sc.exe'

Stage 2: not 1 of filter_optional_avira_driver

or:
CommandLine|contains: 'DisplayName= netprotection_network_filter'
CommandLine|contains: 'binPath= System32\drivers\netprotection_network_filter'
CommandLine|contains: 'create netprotection_network_filter'
CommandLine|contains: 'group= PNP_TDI tag= yes'
CommandLine|contains: 'type= kernel start= '
CommandLine|contains: 'create avelam binpath=C:\Windows\system32\drivers\avelam.sys'
CommandLine|contains: 'type=kernel start=boot error=critical group=Early-Launch'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • DisplayName= netprotection_network_filter
  • binPath corpus 4 (sigma 4)
  • binPath= System32\drivers\netprotection_network_filter
  • config corpus 8 (sigma 8)
  • create corpus 8 (sigma 8)
  • create avelam binpath=C:\Windows\system32\drivers\avelam.sys
  • create netprotection_network_filter
  • group= PNP_TDI tag= yes
  • kernel
  • type corpus 2 (sigma 2)
  • type= kernel start=
  • type=kernel start=boot error=critical group=Early-Launch
Imageends_with
  • \sc.exe corpus 17 (sigma 17)