huntrule

Windows: Clfs.sys Loaded from Suspicious Process Image Paths

Alerts when clfs.sys is loaded by a process running from user/temp/perflogs-style suspicious paths on Windows.

FreeReviewedSigma · Medium · v2
Product
windows
Category
image_load
Author
X__Junior (SigmaHQ), DRL 1.1
Published
2025-01-20
Updated
2026-07-31
AnalysisDetection
title: "Windows: Clfs.sys Loaded from Suspicious Process Image Paths"
id: 0a6de055-0d61-4a43-9423-f4bba73626c7
status: experimental
description: This rule flags image loads where clfs.sys is loaded by a process whose image path is located in common suspicious directories (e.g., Perflogs, Public, Temporary Internet, Windows Temp, or user Favorites/Favourites, Contacts, Pictures). Such DLL/driver loading from unusual locations can indicate exploitation or staging activity rather than normal system behavior. It relies on image load telemetry for the loaded module name (clfs.sys) and the loading process image path.
references:
  - https://ssd-disclosure.com/ssd-advisory-common-log-file-system-clfs-driver-pe/
  - https://x.com/Threatlabz/status/1879956781360976155
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_clfs_load.yml
author: X__Junior, Huntrule Team
date: 2025-01-20
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: image_load
  product: windows
detection:
  selection_dll:
    ImageLoaded|endswith: \clfs.sys
  selection_folders_1:
    Image|contains:
      - :\Perflogs\
      - :\Users\Public\
      - \Temporary Internet
      - \Windows\Temp\
  selection_folders_2:
    - Image|contains|all:
        - :\Users\
        - \Favorites\
    - Image|contains|all:
        - :\Users\
        - \Favourites\
    - Image|contains|all:
        - :\Users\
        - \Contacts\
    - Image|contains|all:
        - :\Users\
        - \Pictures\
  condition: selection_dll and 1 of selection_folders_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: fb4e2211-6d08-426b-8e6f-0d4a161e3b1d
    type: derived