Sunturai
Back to results
MediumSplunk security contentRaven Tait +1

Windows MsMpEng Writing to System32

Detects MsMpEng.exe creating a file in C:\\Windows\\System32\\. This should never happen under normal operation Windows Defender does not install kernel drivers at runtime. In the BlueHammer exploit, the TOCTOU race…

Description

Detects MsMpEng.exe creating a file in C:\\Windows\\System32\\. This should never happen under normal operation Windows Defender does not install kernel drivers at runtime. In the BlueHammer exploit, the TOCTOU race causes MsMpEng (SYSTEM) to write the attacker's driver payload directly into the drivers directory.

Detection logic

Detection requirements

Platform
ContainersLinuxmacOSWindows

The rule states no platform. This is derived from the 2 ATT&CK techniques it maps to.

Log source category
sysmon_eventid_11sysmon_eventid_15

Known benign triggers

  • No false positives have been identified at this time.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice