{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "promote-to-detection",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "BYOVD allows attackers to disable endpoint security from the kernel. Detecting this chain from exposure to loading is critical for protecting server infrastructure."
      },
      "name": "Vulnerable Driver Exploitation and Kernel Escalation",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1190",
        "attack.t1105",
        "attack.t1068"
      ],
      "related": [
        {
          "hunt": "web-shell-behavioral-detection",
          "reason": "This hunt focuses on the driver follow-on; generic web shell behavior is a sibling hunt.",
          "relation": "out-of-scope-alternative"
        }
      ],
      "targets": {
        "web": {
          "name": "Web server / proxy logs",
          "category": "siem",
          "telemetry": [
            "network"
          ]
        },
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        }
      },
      "analysis": "This hunt pivots from vulnerability data to behavioral file and module loads, using stack-counting to identify rare drivers that hash-based rules would miss.",
      "coverage": [
        {
          "stage": "initial-access-exploit",
          "steps": [
            "identify-vulnerable-hosts",
            "detect-staging-traffic"
          ],
          "status": "covered"
        },
        {
          "stage": "vulnerable-driver-delivery",
          "steps": [
            "detect-driver-staging"
          ],
          "status": "covered"
        },
        {
          "stage": "kernel-mode-escalation",
          "steps": [
            "detect-rare-driver-loads"
          ],
          "status": "covered"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "Public-Facing Application Exploit",
            "slug": "initial-access-exploit",
            "tactic": "initial-access",
            "techniques": [
              "T1190"
            ],
            "observables": [
              "Web shell execution from web server processes",
              "Anomalous HTTP requests targeting known vulnerabilities",
              "Vulnerability findings in publicly exposed web applications"
            ]
          },
          {
            "name": "Vulnerable Driver Staging",
            "slug": "vulnerable-driver-delivery",
            "tactic": "execution",
            "techniques": [
              "T1105"
            ],
            "observables": [
              "Creation of .sys driver files in temp or system directories",
              "Driver files matching entries on loldrivers.io",
              "Signed driver binaries with known CVEs or design flaws"
            ]
          },
          {
            "name": "BYOVD Privilege Escalation",
            "slug": "kernel-mode-escalation",
            "tactic": "privilege-escalation",
            "techniques": [
              "T1068"
            ],
            "observables": [
              "Loading of vulnerable kernel modules or drivers",
              "Driver signature verification for known-vulnerable signers",
              "High-integrity processes interacting with newly loaded drivers",
              "Attempts to disable security software via kernel-mode access"
            ]
          }
        ],
        "summary": "The campaign begins with the exploitation of a public-facing application to establish a foothold on a server. Adversaries then drop and load legitimate but vulnerable signed drivers to perform kernel-level operations, achieve privilege escalation, and evade endpoint security."
      },
      "severity": "medium",
      "rationale": "Focus the hunt on Windows servers with internet-facing web roles. Start with critical vulnerability findings (severity 4+) in web server software.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "An adversary has exploited a public-facing application to stage and load a vulnerable kernel driver, bypassing security controls to gain persistent high-integrity access to the host.",
      "parameters": {
        "scope_hosts": {
          "from": {
            "ref": "analyst-scoping",
            "kind": "manual",
            "observed": "2026-07-31"
          },
          "type": "list[host]",
          "default": [],
          "description": "Limit the hunt to specific hosts; leave empty to run against the estate."
        },
        "lookback_days": {
          "from": {
            "ref": "hunt-standard",
            "kind": "manual",
            "observed": "2026-07-31"
          },
          "type": "number",
          "default": "14",
          "description": "Days of history to examine."
        },
        "staging_paths": {
          "from": {
            "ref": "common-knowledge",
            "kind": "manual",
            "observed": "2026-07-31"
          },
          "type": "list[path]",
          "default": [
            "\\temp\\",
            "\\users\\public\\",
            "\\appdata\\local\\temp\\",
            "\\windows\\temp\\"
          ],
          "description": "Common paths where adversaries stage drivers."
        },
        "loldrivers_domains": {
          "from": {
            "ref": "elastic-security-labs-2026",
            "kind": "article",
            "observed": "2026-07-31"
          },
          "type": "list[domain]",
          "default": [
            "loldrivers.io",
            "api.loldrivers.io"
          ],
          "description": "Domains associated with the LOLDrivers project used for staging or reference."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://www.elastic.co/security-labs/blog/elastic-security-black-hat-defcon-2026",
          "gates": [
            "dry-run",
            "lint",
            "critic"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://www.elastic.co/security-labs/blog/elastic-security-black-hat-defcon-2026",
          "name": "Elastic Security Labs \u2014 Elastic goes all-in on Hacker Summer Camp"
        },
        {
          "url": "https://loldrivers.io/",
          "name": "LOLDrivers Project"
        }
      ],
      "blind_spots": [
        {
          "id": "missing-vulnerability-telemetry",
          "risk": "An unmanaged or unscanned server might be exploited without appearing in the lead query.",
          "stage": "initial-access-exploit",
          "question": "Are all internet-facing servers covered by current vulnerability scans?",
          "requires": "hb_vulnerability_finding with frequent scan cycles"
        },
        {
          "id": "no-kernel-visibility",
          "risk": "Without module load telemetry, we see the delivery but cannot verify successful escalation.",
          "stage": "kernel-mode-escalation",
          "question": "Can we confirm the driver was loaded into kernel space?",
          "requires": "hb_module_activity with Sysmon Event ID 6"
        }
      ]
    },
    "name": "Vulnerable Driver Exploitation and Kernel Escalation",
    "description": "An adversary exploits an internet-facing application to stage a vulnerable driver and escalate to the kernel. The hunt first identifies hosts with critical web-server vulnerabilities through software findings. If vulnerable hosts are identified, the hunt fans out to look for behavioral indicators: the creation of .sys files in atypical paths, rare kernel module loads, and HTTP traffic to staging domains like LOLDrivers.io. A second agent evaluates the combined evidence to distinguish administrative maintenance from malicious kernel-mode escalation. The analyst reviews the final verdict and isolates any compromised endpoints."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "coverage": [
          {
            "stage": "initial-access-exploit",
            "steps": [
              "identify-vulnerable-hosts",
              "detect-staging-traffic"
            ],
            "status": "covered"
          },
          {
            "stage": "vulnerable-driver-delivery",
            "steps": [
              "detect-driver-staging"
            ],
            "status": "covered"
          },
          {
            "stage": "kernel-mode-escalation",
            "steps": [
              "detect-rare-driver-loads"
            ],
            "status": "covered"
          }
        ],
        "rationale": "An adversary has exploited a public-facing application to stage and load a vulnerable kernel driver, bypassing security controls to gain persistent high-integrity access to the host.",
        "blind_spots": [
          {
            "id": "missing-vulnerability-telemetry",
            "risk": "An unmanaged or unscanned server might be exploited without appearing in the lead query.",
            "stage": "initial-access-exploit",
            "question": "Are all internet-facing servers covered by current vulnerability scans?",
            "requires": "hb_vulnerability_finding with frequent scan cycles"
          },
          {
            "id": "no-kernel-visibility",
            "risk": "Without module load telemetry, we see the delivery but cannot verify successful escalation.",
            "stage": "kernel-mode-escalation",
            "question": "Can we confirm the driver was loaded into kernel space?",
            "requires": "hb_module_activity with Sysmon Event ID 6"
          }
        ],
        "scoping_notes": "Focus the hunt on Windows servers with internet-facing web roles. Start with critical vulnerability findings (severity 4+) in web server software.",
        "beyond_detection": "This hunt pivots from vulnerability data to behavioral file and module loads, using stack-counting to identify rare drivers that hash-based rules would miss."
      }
    },
    {
      "id": "identify-vulnerable-hosts",
      "type": "query",
      "label": "Identify vulnerable internet-facing servers",
      "config": {
        "dsl": "sqlite",
        "role": "scoping",
        "source": "endpoint",
        "content": "SELECT device_uid, cve_uid, severity, affected_package_name FROM hb_vulnerability_finding WHERE (severity_id >= 4 OR is_kev = 1) AND (LOWER(affected_package_name) LIKE '%http%' OR LOWER(affected_package_name) LIKE '%server%' OR LOWER(affected_package_name) LIKE '%iis%' OR LOWER(affected_package_name) LIKE '%apache%')",
        "surface": "hb_vulnerability_finding",
        "description": "Find hosts with high-severity vulnerabilities in web server packages to focus the hunt.",
        "expected_signal": "A list of host IDs and CVEs. Silence indicates no known critical web-facing vulnerabilities exist in the current scan results."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "scoping",
        "label": "Identify vulnerable internet-facing servers",
        "reads": [
          "device_uid",
          "cve_uid",
          "severity",
          "affected_package_name"
        ],
        "source": "hb_vulnerability_finding",
        "target": "endpoint",
        "content": "SELECT device_uid, cve_uid, severity, affected_package_name FROM hb_vulnerability_finding WHERE (severity_id >= 4 OR is_kev = 1) AND (LOWER(affected_package_name) LIKE '%http%' OR LOWER(affected_package_name) LIKE '%server%' OR LOWER(affected_package_name) LIKE '%iis%' OR LOWER(affected_package_name) LIKE '%apache%')",
        "silence": "not_evidence_of_absence",
        "expected": "A list of host IDs and CVEs. Silence indicates no known critical web-facing vulnerabilities exist in the current scan results.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "assess-vulnerability-lead",
      "type": "analytic",
      "label": "Assess vulnerability lead",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "web"
        ],
        "context": [
          "identify-vulnerable-hosts"
        ],
        "objective": "Evaluate whether the identified vulnerabilities in identify-vulnerable-hosts represent a plausible entry point for an adversary seeking kernel escalation.",
        "description": "Determine if identified vulnerabilities are relevant to the BYOVD scenario.",
        "max_iterations": 3,
        "expected_signal": "A confirmed list of high-risk hosts for follow-on investigation.",
        "success_criteria": "A risk-ranked list of hosts to carry into the behavioral phase."
      },
      "parents": [
        {
          "id": "identify-vulnerable-hosts"
        }
      ]
    },
    {
      "id": "gate-on-risk",
      "type": "checkpoint",
      "label": "Gate on vulnerability risk",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the assess-vulnerability-lead verdict identifies at least one host with critical web-server exposure",
        "condition": "the assess-vulnerability-lead verdict identifies at least one host with critical web-server exposure",
        "blind_spot": "missing-vulnerability-telemetry",
        "confidence": "high",
        "description": "Stop the hunt if no high-risk vulnerable hosts are identified.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "assess-vulnerability-lead"
        }
      ]
    },
    {
      "id": "detect-driver-staging",
      "type": "query",
      "label": "Driver file staging",
      "config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "source": "endpoint",
        "content": "SELECT device_hostname, file_name, file_path, process_name, time FROM hb_file_activity WHERE LOWER(file_name) LIKE '%.sys' AND (instr(',' || '{{staging_paths}}' || ',', ',' || LOWER(file_path) || ',') > 0 OR LOWER(file_path) LIKE '%\\temp\\%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_file_activity",
        "description": "Find .sys files created in user-writable or temporary directories.",
        "expected_signal": "Driver files in temporary paths; these are anomalies compared to standard System32 drivers."
      },
      "parents": [
        {
          "id": "gate-on-risk",
          "branch": "on_supports"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "label": "Driver file staging",
        "reads": [
          "device_hostname",
          "file_name",
          "file_path",
          "process_name",
          "time"
        ],
        "source": "hb_file_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, file_name, file_path, process_name, time FROM hb_file_activity WHERE LOWER(file_name) LIKE '%.sys' AND (instr(',' || '{{staging_paths}}' || ',', ',' || LOWER(file_path) || ',') > 0 OR LOWER(file_path) LIKE '%\\temp\\%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "Driver files in temporary paths; these are anomalies compared to standard System32 drivers.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "detect-rare-driver-loads",
      "type": "query",
      "label": "Rare kernel module loads",
      "config": {
        "dsl": "sqlite",
        "role": "baseline",
        "source": "endpoint",
        "content": "SELECT module_name, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_module_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY module_name HAVING host_count <= 3",
        "surface": "hb_module_activity",
        "description": "Stack-count driver loads to identify rare modules that may be vulnerable drivers.",
        "expected_signal": "Drivers loaded on very few hosts. Legitimate OS drivers appear fleet-wide."
      },
      "parents": [
        {
          "id": "gate-on-risk",
          "branch": "on_supports"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "baseline",
        "label": "Rare kernel module loads",
        "reads": [
          "module_name",
          "device_hostname",
          "time"
        ],
        "source": "hb_module_activity",
        "target": "endpoint",
        "content": "SELECT module_name, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_module_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY module_name HAVING host_count <= 3",
        "silence": "not_evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "first_seen"
        },
        "expected": "Drivers loaded on very few hosts. Legitimate OS drivers appear fleet-wide.",
        "verified": "dry-run",
        "prevalence": {
          "by": "device_hostname",
          "key": [
            "module_name"
          ],
          "rare_below": 3
        },
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "detect-staging-traffic",
      "type": "query",
      "label": "HTTP traffic to staging domains",
      "config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "source": "web",
        "content": "SELECT device_hostname, url_hostname, url_path, src_endpoint_ip, time FROM hb_http_activity WHERE instr(',' || '{{loldrivers_domains}}' || ',', ',' || LOWER(url_hostname) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_http_activity",
        "description": "Identify hosts reaching out to repositories like LOLDrivers.io.",
        "expected_signal": "Direct network contact with driver documentation or staging sites from the server."
      },
      "parents": [
        {
          "id": "gate-on-risk",
          "branch": "on_supports"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "label": "HTTP traffic to staging domains",
        "reads": [
          "device_hostname",
          "url_hostname",
          "url_path",
          "src_endpoint_ip",
          "time"
        ],
        "source": "hb_http_activity",
        "target": "web",
        "content": "SELECT device_hostname, url_hostname, url_path, src_endpoint_ip, time FROM hb_http_activity WHERE instr(',' || '{{loldrivers_domains}}' || ',', ',' || LOWER(url_hostname) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "Direct network contact with driver documentation or staging sites from the server.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "triage-byovd-intrusion",
      "type": "analytic",
      "label": "Triage BYOVD intrusion",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "web"
        ],
        "context": [
          "assess-vulnerability-lead",
          "detect-driver-staging",
          "detect-rare-driver-loads",
          "detect-staging-traffic"
        ],
        "objective": "Determine if an adversary exploited a host and escalated to the kernel. Correlate vulnerable server findings with driver file creation, rare module loads, and staging traffic.",
        "description": "Weigh the combined evidence of exposure, staging, and execution to reach a verdict.",
        "max_iterations": 6,
        "expected_signal": "A per-host verdict citing specific rows from all four queries.",
        "success_criteria": "A final verdict of malicious, suspicious, or benign per host."
      },
      "parents": [
        {
          "id": "detect-driver-staging",
          "kind": "merge"
        },
        {
          "id": "detect-rare-driver-loads",
          "kind": "merge"
        },
        {
          "id": "detect-staging-traffic",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "route-on-verdict",
      "type": "checkpoint",
      "label": "Route on BYOVD verdict",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the triage verdict is malicious for at least one host",
        "condition": "the triage verdict is malicious for at least one host",
        "blind_spot": "no-kernel-visibility",
        "confidence": "high",
        "description": "Initiate response or manual review based on the triage verdict.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "triage-byovd-intrusion"
        }
      ]
    },
    {
      "id": "contain-host",
      "type": "action",
      "label": "Isolate host",
      "config": {
        "target": "endpoint",
        "description": "Contain the threat and prevent further kernel-level operations.",
        "instructions": "Isolate the host immediately. Collect the suspicious driver file and the current kernel memory map.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "manual-validation",
      "type": "task",
      "label": "Manual validation",
      "config": {
        "assignee": "analyst",
        "description": "Perform expert review of the findings and tune parameters.",
        "instructions": "Verify the relationship between the web server process and the driver creation. Cross-reference the driver hash with known vulnerable driver databases."
      },
      "parents": [
        {
          "id": "gate-on-risk",
          "branch": "default"
        },
        {
          "id": "gate-on-risk",
          "branch": "on_unavailable"
        },
        {
          "id": "route-on-verdict",
          "branch": "default"
        },
        {
          "id": "route-on-verdict",
          "branch": "on_unavailable"
        },
        {
          "id": "contain-host"
        }
      ]
    },
    {
      "id": "close-out-hunt",
      "type": "task",
      "label": "Close out hunt",
      "config": {
        "assignee": "analyst",
        "description": "Finalize documentation and record findings.",
        "instructions": "Record all examined hosts. Document any confirmed infections or false positives for future tuning."
      },
      "parents": [
        {
          "id": "gate-on-risk",
          "branch": "on_refutes"
        },
        {
          "id": "route-on-verdict",
          "branch": "on_refutes"
        },
        {
          "id": "manual-validation"
        }
      ]
    }
  ]
}