Windows Driver File MoriyaStreamWatchmen.sys Created in System32\drivers

Alerts when the Windows system32 drivers directory receives the MoriyaStreamWatchmen.sys file.

FreeReviewedSigma · Critical · v5

Product: windows
Category: file_event
Author: Bhabesh Raj (SigmaHQ), DRL 1.1
Published: 2021-05-06
Updated: 2026-07-31

ATT&CK techniques

Persistence → Priv Esc

Recon
Resource Dev
Initial Access
Execution
Persistence
- T1543.003Windows Service
Priv Esc
- T1543.003Windows Service
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule triggers when the file event creates or writes a specific driver filename, MoriyaStreamWatchmen.sys, at C:\Windows\System32\drivers. Creating a kernel driver in this location is a common persistence and privilege-escalation technique because it can load with system privileges. The detection relies on Windows file event telemetry that records the target file path and name for newly created driver files.

Reporting behind it

Related detections9 linkedT1543.003 — drag to rearrange

Suspicious Service DLL Hijack of IKEEXT or PrintNotify

Service Hiding via SC Sdset Security Descriptor Modification

Malicious Service DLL Hijack for Persistence via Lotus Blossom

Malicious TinyTurla ServiceDll Registration via svchost Group (via registry_set)

Suspicious ToyMaker LAGTOY Service Creation Masquerading as WmiPrvSV via sc.exe

Malicious Service Creation With Autostart binPath via sc.exe (via process_creation)

Malicious svchost Service Creation for TinyTurla Persistence (via process_creation)

Malicious Service Creation Masquerading as nslookup (via process_creation)

Interactive Service Creation Executing cmd via sc.exe

Windows Driver File MoriyaStreamWatchmen.sys Created in System32\drivers

Pivot detection · T1543.003 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-detect-creation-of-moriyastreamwatchmen-sys-driver-file-a1507d71

title: Windows Driver File MoriyaStreamWatchmen.sys Created in System32\drivers
id: 04e656a7-7557-4fb4-8b5e-a8a43c7827a4
related:
  - id: 25b9c01c-350d-4b95-bed1-836d04a4f324
    type: derived
  - id: a1507d71-0b60-44f6-b17c-bf53220fdd88
    type: derived
status: test
description: This rule triggers when the file event creates or writes a specific driver filename, MoriyaStreamWatchmen.sys, at C:\Windows\System32\drivers. Creating a kernel driver in this location is a common persistence and privilege-escalation technique because it can load with system privileges. The detection relies on Windows file event telemetry that records the target file path and name for newly created driver files.
references:
  - https://securelist.com/operation-tunnelsnake-and-moriya-rootkit/101831
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Malware/Moriya-Rootkit/file_event_win_moriya_rootkit.yml
author: Bhabesh Raj, Huntrule Team
date: 2021-05-06
modified: 2023-05-05
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1543.003
  - detection.emerging-threats
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename: C:\Windows\System32\drivers\MoriyaStreamWatchmen.sys
  condition: selection
falsepositives:
  - Unknown
level: critical
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL