1200KM / sigma-rule
Suspicious VBoxDrvInst.exe Parameters — Sigma Rule
Sigma rule b7b19cb6-9b32-4fc4-a108-73f19acfe262. Suspicious VBoxDrvInst.exe Parameters — Sigma Rule. Detect VBoxDrvInst.exe run with parameters allowing processing INF file. This allows to create values in the registry and install drivers. For example one could use this technique to obtain persistence via modifying one of Run or RunOnce registry keys
Rule metadata and linked tags
Author: Konstantin Grishchenko, oscd.community. Source status: test; severity: medium. Source dates: 2020-10-06 / 2021-11-27.
{
"category": "process_creation",
"product": "windows"
}Pinned original Sigma rule · Detection Rule License 1.1
Source SHA-256: d78e7fd3bdc1bd5d489e728ec33cc01a907ea227fa5aac1f518aaccb20d00714
Detection logic
Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.
title: Suspicious VBoxDrvInst.exe Parameters
id: b7b19cb6-9b32-4fc4-a108-73f19acfe262
status: test
description: |
Detect VBoxDrvInst.exe run with parameters allowing processing INF file.
This allows to create values in the registry and install drivers.
For example one could use this technique to obtain persistence via modifying one of Run or RunOnce registry keys
references:
- https://github.com/LOLBAS-Project/LOLBAS/blob/4db780e0f0b2e2bb8cb1fa13e09196da9b9f1834/yml/LOLUtilz/OtherBinaries/VBoxDrvInst.yml
- https://twitter.com/pabraeken/status/993497996179492864
author: Konstantin Grishchenko, oscd.community
date: 2020-10-06
modified: 2021-11-27
tags:
- attack.persistence
- attack.defense-impairment
- attack.t1112
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: '\VBoxDrvInst.exe'
CommandLine|contains|all:
- 'driver'
- 'executeinf'
condition: selection
falsepositives:
- Legitimate use of VBoxDrvInst.exe utility by VirtualBox Guest Additions installation process
level: medium
False positives
- Legitimate use of VBoxDrvInst.exe utility by VirtualBox Guest Additions installation process
Source references
Connected ecosystem references
Exact source-tagged techniques
Telemetry review
Read the original logsource above, then inspect the linked detection workspaces for technique-level sensor context. No per-rule telemetry equivalence is inferred.
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.