Clfs.SYS Loaded By Process Located In a Possible Suspicious Location (via image_load)

title: Clfs.SYS Loaded By Process Located In a Possible Suspicious Location (via image_load)
id: e40b09a5-97a8-5103-b721-37e60a679efa
status: stable
description: This rule detects Clfs.sys being loaded by a process running from a potentially anomalous location. Clfs.sys is loaded as part of many CVEs exploits that targets Common Log File.
references:
    - https://attack.mitre.org/techniques/T1059/
    - https://ssd-disclosure.com/ssd-advisory-common-log-file-system-clfs-driver-pe/
    - https://x.com/Threatlabz/status/1879956781360976155
author: Huntrule Team
date: 2026-01-17
tags:
    - attack.execution
    - attack.t1059
logsource:
    category: image_load
    product: windows
detection:
    selection_dll:
        ImageLoaded|endswith: '\clfs.sys'
    selection_folders_1:
        Image|contains:
            - ':\Perflogs\'
            - ':\Users\Public\'
            - '\Temporary Internet'
            - '\Windows\Temp\'
    selection_folders_2:
        - Image|contains|all:
              - ':\Users\'
              - '\Favorites\'
        - Image|contains|all:
              - ':\Users\'
              - '\Favourites\'
        - Image|contains|all:
              - ':\Users\'
              - '\Contacts\'
        - Image|contains|all:
              - ':\Users\'
              - '\Pictures\'
    condition: selection_dll and 1 of selection_folders_*
falsepositives:
    - Unknown
level: medium