{"id":"b7b19cb6-9b32-4fc4-a108-73f19acfe262","title":"Suspicious VBoxDrvInst.exe Parameters","description":"Detect VBoxDrvInst.exe run with parameters allowing processing INF file.\nThis allows to create values in the registry and install drivers.\nFor example one could use this technique to obtain persistence via modifying one of Run or RunOnce registry keys\n","author":"Konstantin Grishchenko, oscd.community","status":"test","level":"medium","date":"2020-10-06","modified":"2021-11-27","tags":["attack.persistence","attack.defense-impairment","attack.t1112"],"technique_ids":["T1112"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Legitimate use of VBoxDrvInst.exe utility by VirtualBox Guest Additions installation process"],"references":["https://github.com/LOLBAS-Project/LOLBAS/blob/4db780e0f0b2e2bb8cb1fa13e09196da9b9f1834/yml/LOLUtilz/OtherBinaries/VBoxDrvInst.yml","https://twitter.com/pabraeken/status/993497996179492864"],"source_path":"rules/windows/process_creation/proc_creation_win_virtualbox_vboxdrvinst_execution.yml","source_sha256":"d78e7fd3bdc1bd5d489e728ec33cc01a907ea227fa5aac1f518aaccb20d00714","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_virtualbox_vboxdrvinst_execution.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious VBoxDrvInst.exe Parameters\nid: b7b19cb6-9b32-4fc4-a108-73f19acfe262\nstatus: test\ndescription: |\n  Detect VBoxDrvInst.exe run with parameters allowing processing INF file.\n  This allows to create values in the registry and install drivers.\n  For example one could use this technique to obtain persistence via modifying one of Run or RunOnce registry keys\nreferences:\n    - https://github.com/LOLBAS-Project/LOLBAS/blob/4db780e0f0b2e2bb8cb1fa13e09196da9b9f1834/yml/LOLUtilz/OtherBinaries/VBoxDrvInst.yml\n    - https://twitter.com/pabraeken/status/993497996179492864\nauthor: Konstantin Grishchenko, oscd.community\ndate: 2020-10-06\nmodified: 2021-11-27\ntags:\n    - attack.persistence\n    - attack.defense-impairment\n    - attack.t1112\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        Image|endswith: '\\VBoxDrvInst.exe'\n        CommandLine|contains|all:\n            - 'driver'\n            - 'executeinf'\n    condition: selection\nfalsepositives:\n    - Legitimate use of VBoxDrvInst.exe utility by VirtualBox Guest Additions installation process\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1112","id":"T1112","name":"Modify Registry","page":"techniques/enterprise/T1112/"}],"data_path":"data/detection-rules/b7b19cb6-9b32-4fc4-a108-73f19acfe262.json","kind":"sigma"}