Driver Load (3551476e-14f5-4e48-a518-e82135329e03)
The process of attaching a driver, which is a software component that allows the operating system and applications to interact with hardware devices, to either user-mode or kernel-mode of a system. This can include benign actions (e.g., hardware drivers) or malicious behavior (e.g., rootkits or unsigned drivers). Examples:
- Legitimate Driver Loading: A new graphics driver from a vendor like NVIDIA or AMD is loaded into the system.
- Unsigned Driver Loading: A driver without a valid digital signature is loaded into the kernel.
- Rootkit Installation: A malicious rootkit driver is loaded to manipulate kernel-mode processes.
- Anti-Virus or EDR Driver Loading: An Endpoint Detection and Response (EDR) solution loads its driver to monitor system activities.
- Driver Misuse: A legitimate driver is loaded and exploited to execute malicious actions, such as using vulnerable drivers for bypassing defenses (e.g., Bring Your Own Vulnerable Driver (BYOVD) attacks).
This data component can be collected through the following measures:
Windows
- Sysmon Logs:
- Event ID 6: Captures driver loading activity, including file path, hashes, and signature information.
- Configuration: Ensure Sysmon is configured with a ruleset that monitors driver loading events
- Windows Event Logs: Enable "Audit Kernel Object" to capture kernel-related driver loading events.
Linux
- Auditd: Configure audit rules to capture driver loading events:
auditctl -w /lib/modules/ -p rwxa -k driver_load - Kernel Logs (dmesg): Use dmesg to monitor driver-related activities:
dmesg | grep "module" - Syslog or journald: Review logs for module insertion or removal activities.
macOS
- Unified Logs: Use the macOS unified logging system to monitor kext (kernel extension) loads:
log show --predicate 'eventMessage contains "kext load"' - Endpoint Security Framework: Monitor driver loading via third-party security tools that leverage Apple’s Endpoint Security Framework.
SIEM Tools
- Ingest driver load logs from Sysmon, Auditd, or macOS unified logs into a centralized SIEM (e.g., Splunk).
- Create rules to detect unsigned drivers, rootkit activity, or known vulnerable drivers.
EDR Solutions
- Use EDR tools to detect and alert on anomalous driver loading activity.