Windows: Clfs.sys Loaded from Suspicious Process Image Paths
Alerts when clfs.sys is loaded by a process running from user/temp/perflogs-style suspicious paths on Windows.
- Product
- windows
- Category
- image_load
- Author
- X__Junior (SigmaHQ), DRL 1.1
- Published
- 2025-01-20
- Updated
- 2026-07-31
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags image loads where clfs.sys is loaded by a process whose image path is located in common suspicious directories (e.g., Perflogs, Public, Temporary Internet, Windows Temp, or user Favorites/Favourites, Contacts, Pictures). Such DLL/driver loading from unusual locations can indicate exploitation or staging activity rather than normal system behavior. It relies on image load telemetry for the loaded module name (clfs.sys) and the loading process image path.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Clfs.sys Loaded from Suspicious Process Image Paths"
id: 0a6de055-0d61-4a43-9423-f4bba73626c7
status: experimental
description: This rule flags image loads where clfs.sys is loaded by a process whose image path is located in common suspicious directories (e.g., Perflogs, Public, Temporary Internet, Windows Temp, or user Favorites/Favourites, Contacts, Pictures). Such DLL/driver loading from unusual locations can indicate exploitation or staging activity rather than normal system behavior. It relies on image load telemetry for the loaded module name (clfs.sys) and the loading process image path.
references:
- https://ssd-disclosure.com/ssd-advisory-common-log-file-system-clfs-driver-pe/
- https://x.com/Threatlabz/status/1879956781360976155
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_clfs_load.yml
author: X__Junior, Huntrule Team
date: 2025-01-20
tags:
- attack.execution
- attack.t1059
logsource:
category: image_load
product: windows
detection:
selection_dll:
ImageLoaded|endswith: \clfs.sys
selection_folders_1:
Image|contains:
- :\Perflogs\
- :\Users\Public\
- \Temporary Internet
- \Windows\Temp\
selection_folders_2:
- Image|contains|all:
- :\Users\
- \Favorites\
- Image|contains|all:
- :\Users\
- \Favourites\
- Image|contains|all:
- :\Users\
- \Contacts\
- Image|contains|all:
- :\Users\
- \Pictures\
condition: selection_dll and 1 of selection_folders_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: fb4e2211-6d08-426b-8e6f-0d4a161e3b1d
type: derived