Cpe:2.3:o:asrock:rgb_driver_firmware:-:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3oasrockrgb_driver_firmware-/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 02 Jan 2024 12:00:00 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgDetection of Vulnerable Driver Loading on Windows Systemshttps://feed.craftedsignal.io/briefs/2024-01-vulnerable-driver-load/Tue, 02 Jan 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-vulnerable-driver-load/Detection of loading known vulnerable Windows drivers that may indicate persistence or privilege escalation attempts via exploitation.This brief focuses on the detection of vulnerable Windows drivers being loaded into the system, which is a common tactic used by threat actors to achieve persistence and/or escalate privileges. The loading of these drivers can be indicative of ongoing exploitation attempts. This behavior is detected via analysis of Windows Sysmon Event ID 6, which logs driver loading events. Attackers leverage vulnerable drivers to bypass security controls and execute arbitrary code at elevated privilege levels. Successful exploitation can lead to complete system compromise and sensitive data exfiltration. This activity is particularly relevant due to the increasing number of publicly known vulnerable drivers and readily available exploitation techniques. Some drivers are intentionally backdoored, while others have flaws that are exploited.

Attack Chain

  1. An attacker gains initial access to the system through various means, such as exploiting a vulnerability in a user-mode application or through social engineering.
  2. The attacker identifies a vulnerable driver present on the system or deploys a malicious vulnerable driver to disk.
  3. The attacker leverages a known exploit (e.g., CVE-2022-37969) to load the vulnerable driver into the kernel.
  4. Upon successful loading, the vulnerable driver can be used to overwrite critical system data or execute arbitrary code within the kernel context.
  5. The attacker utilizes the elevated privileges gained through the vulnerable driver to inject malicious code into other processes or modify system configurations.
  6. The attacker establishes persistence by creating new services, modifying registry keys, or planting backdoors within the system.
  7. With elevated privileges and persistence established, the attacker can now perform further malicious activities, such as data exfiltration or lateral movement.
  8. The attacker achieves their objective, such as deploying ransomware, stealing sensitive data, or disrupting critical systems.

Impact

Compromise via vulnerable driver exploitation can have severe consequences. Successful exploitation grants attackers SYSTEM level privileges, enabling them to bypass security controls, disable security products, and gain complete control over the compromised system. This can lead to data theft, ransomware deployment, and disruption of critical business operations. There are various vulnerable drivers present in many Windows systems.

Recommendation

  • Enable Sysmon Event ID 6 to monitor driver loading events on Windows endpoints to enable the rules below.
  • Deploy the Sigma rules provided to detect the loading of known vulnerable drivers (e.g., based on ImageLoaded field and cross-referencing with lists of known vulnerable drivers) and tune for your environment.
  • Regularly review and update the list of known vulnerable drivers used in the detection rules to incorporate newly discovered vulnerabilities.
  • Implement driver block rules using Windows Defender Application Control to prevent the loading of known vulnerable drivers.
  • Investigate any alerts generated by these rules promptly to identify and contain potential exploitation attempts.
]]>highadvisoryvulnerable-driverprivilege-escalationpersistencewindows