{"id":"431a1fdb-4799-4f3b-91c3-a683b003fc49","title":"New Kernel Driver Via SC.EXE","description":"Detects creation of a new service (kernel driver) with the type \"kernel\"","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2022-07-14","modified":"2025-10-07","tags":["attack.persistence","attack.privilege-escalation","attack.t1543.003"],"technique_ids":["T1543.003"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Rare legitimate installation of kernel drivers via sc.exe"],"references":["https://www.aon.com/cyber-solutions/aon_cyber_labs/yours-truly-signed-av-driver-weaponizing-an-antivirus-driver/"],"source_path":"rules/windows/process_creation/proc_creation_win_sc_new_kernel_driver.yml","source_sha256":"de52f94de2be27c69d8b7953aabb3b2587739efa91bffbb57858dc240899c051","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_sc_new_kernel_driver.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: New Kernel Driver Via SC.EXE\nid: 431a1fdb-4799-4f3b-91c3-a683b003fc49\nstatus: test\ndescription: Detects creation of a new service (kernel driver) with the type \"kernel\"\nreferences:\n    - https://www.aon.com/cyber-solutions/aon_cyber_labs/yours-truly-signed-av-driver-weaponizing-an-antivirus-driver/\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2022-07-14\nmodified: 2025-10-07\ntags:\n    - attack.persistence\n    - attack.privilege-escalation\n    - attack.t1543.003\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        Image|endswith: '\\sc.exe'\n        CommandLine|contains:\n            - 'create'\n            - 'config'\n        CommandLine|contains|all:\n            - 'binPath'\n            - 'type'\n            - 'kernel'\n    filter_optional_avira_driver:\n        - CommandLine|contains|all:\n              - 'create netprotection_network_filter'\n              - 'type= kernel start= '\n              - 'binPath= System32\\drivers\\netprotection_network_filter'\n              - 'DisplayName= netprotection_network_filter'\n              - 'group= PNP_TDI tag= yes'\n        - CommandLine|contains|all:\n              - 'create avelam binpath=C:\\Windows\\system32\\drivers\\avelam.sys'\n              - 'type=kernel start=boot error=critical group=Early-Launch'\n    condition: selection and not 1 of filter_optional_*\nfalsepositives:\n    - Rare legitimate installation of kernel drivers via sc.exe\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1543.003","id":"T1543.003","name":"Windows Service","page":"techniques/enterprise/T1543.003/"}],"data_path":"data/detection-rules/431a1fdb-4799-4f3b-91c3-a683b003fc49.json","kind":"sigma"}