Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

MediumSplunk security contentThreat hunting

Windows System File on Disk

The following analytic detects the creation of new .sys files on disk. It leverages the Endpoint.Filesystem data model to identify and log instances where .sys files are written to the filesystem. This activity is significant because .sys files are often used as kernel mode drivers, and their unauthorized creation can indicate malicious activity such as rootkit installation. If confirmed malicious, this could allow an attacker to gain kernel-level access, leading to full system compromise, persistent control, and the ability to bypass security mechanisms.

ATT&CK coverage

Outside the enterprise matrix

T1068Exploitation for Privilege Escalation 141 detections cover this technique

Detection requirements

Log source category: sysmon_eventid_11

What the source says

What fires this without an attack behind it

False positives will be present. Filter as needed.

References

https://redcanary.com/blog/tracking-driver-inventory-to-expose-rootkits/

Tagged by the source as

CISA AA22-264ACrypto StealerWindows DriversEndpointendpointSplunk CloudSplunk EnterpriseSplunk Enterprise Securityendpoint

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.