{"id":"fb4e2211-6d08-426b-8e6f-0d4a161e3b1d","title":"Clfs.SYS Loaded By Process Located In a Potential Suspicious Location","description":"Detects Clfs.sys being loaded by a process running from a potentially suspicious location. Clfs.sys is loaded as part of many CVEs exploits that targets Common Log File.","author":"X__Junior","status":"experimental","level":"medium","date":"2025-01-20","modified":"","tags":["attack.execution","attack.t1059"],"technique_ids":["T1059"],"logsource":{"category":"image_load","product":"windows"},"falsepositives":["Unknown"],"references":["https://ssd-disclosure.com/ssd-advisory-common-log-file-system-clfs-driver-pe/","https://x.com/Threatlabz/status/1879956781360976155"],"source_path":"rules/windows/image_load/image_load_clfs_load.yml","source_sha256":"0d973b2448f277675d269a1fb510d570c49754f3594abfcb1c2fece55f6d90fa","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/image_load/image_load_clfs_load.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Clfs.SYS Loaded By Process Located In a Potential Suspicious Location\nid: fb4e2211-6d08-426b-8e6f-0d4a161e3b1d\nstatus: experimental\ndescription: Detects Clfs.sys being loaded by a process running from a potentially suspicious location. Clfs.sys is loaded as part of many CVEs exploits that targets Common Log File.\nreferences:\n    - https://ssd-disclosure.com/ssd-advisory-common-log-file-system-clfs-driver-pe/\n    - https://x.com/Threatlabz/status/1879956781360976155\nauthor: X__Junior\ndate: 2025-01-20\ntags:\n    - attack.execution\n    - attack.t1059\nlogsource:\n    category: image_load\n    product: windows\ndetection:\n    selection_dll:\n        ImageLoaded|endswith: '\\clfs.sys'\n    selection_folders_1:\n        Image|contains:\n            - ':\\Perflogs\\'\n            - ':\\Users\\Public\\'\n            - '\\Temporary Internet'\n            - '\\Windows\\Temp\\'\n    selection_folders_2:\n        - Image|contains|all:\n              - ':\\Users\\'\n              - '\\Favorites\\'\n        - Image|contains|all:\n              - ':\\Users\\'\n              - '\\Favourites\\'\n        - Image|contains|all:\n              - ':\\Users\\'\n              - '\\Contacts\\'\n        - Image|contains|all:\n              - ':\\Users\\'\n              - '\\Pictures\\'\n    condition: selection_dll and 1 of selection_folders_*\nfalsepositives:\n    - Unknown\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059","id":"T1059","name":"Command and Scripting Interpreter","page":"techniques/enterprise/T1059/"}],"data_path":"data/detection-rules/fb4e2211-6d08-426b-8e6f-0d4a161e3b1d.json","kind":"sigma"}