Detectionhightest

Driver Load From A Temporary Directory

Detects a driver load from a temporary directory

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Florian Roth (Nextron Systems)Created Sun Feb 12Updated Sat Nov 272c4523d5-d481-4ed0-8ec3-7fbf0cb41a75windows

Log Source

WindowsDriver Load

ProductWindows← raw: windows

CategoryDriver Load← raw: driver_load

Detection Logic

detection:
    selection:
        ImageLoaded|contains: '\Temp\'
    condition: selection

False Positives

There is a relevant set of false positives depending on applications in the environment

References

Resolving title…

Internal Research

MITRE ATT&CK

Tactics

Sub-techniques

Rule Metadata

Rule ID

2c4523d5-d481-4ed0-8ec3-7fbf0cb41a75

Status

test

Level

high

Type

Detection

Created

Sun Feb 12

Modified

Sat Nov 27

Author

Path

rules/windows/driver_load/driver_load_win_susp_temp_use.yml

Raw Tags

attack.persistenceattack.privilege-escalationattack.t1543.003