Windows: Clfs.sys Image Loaded from Potentially Suspicious User or Temp Paths

title: "Windows: Clfs.sys Image Loaded from Potentially Suspicious User or Temp Paths"
id: 0a6de055-0d61-4a43-9423-f4bba73626c7
status: experimental
description: This rule flags events where Clfs.sys is loaded by a process whose image path is located in commonly abused or user-writable locations such as Perflogs, Public, Temporary Internet, or Windows Temp, or within specific user subfolders. Loading this driver from unexpected locations can indicate exploitation attempts targeting Common Log File System behavior. The detection relies on image-load telemetry that provides the loaded image name (clfs.sys) and the full process image path.
references:
  - https://ssd-disclosure.com/ssd-advisory-common-log-file-system-clfs-driver-pe/
  - https://x.com/Threatlabz/status/1879956781360976155
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_clfs_load.yml
author: X__Junior, Huntrule Team
date: 2025-01-20
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: image_load
  product: windows
detection:
  selection_dll:
    ImageLoaded|endswith: \clfs.sys
  selection_folders_1:
    Image|contains:
      - :\Perflogs\
      - :\Users\Public\
      - \Temporary Internet
      - \Windows\Temp\
  selection_folders_2:
    - Image|contains|all:
        - :\Users\
        - \Favorites\
    - Image|contains|all:
        - :\Users\
        - \Favourites\
    - Image|contains|all:
        - :\Users\
        - \Contacts\
    - Image|contains|all:
        - :\Users\
        - \Pictures\
  condition: selection_dll and 1 of selection_folders_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: fb4e2211-6d08-426b-8e6f-0d4a161e3b1d
    type: derived