Windows: Detect creation of MoriyaStreamWatchmen.sys driver file

title: "Windows: Detect creation of MoriyaStreamWatchmen.sys driver file"
id: 04e656a7-7557-4fb4-8b5e-a8a43c7827a4
related:
  - id: 25b9c01c-350d-4b95-bed1-836d04a4f324
    type: derived
  - id: a1507d71-0b60-44f6-b17c-bf53220fdd88
    type: derived
status: test
description: This rule identifies the creation of a specific driver file at C:\Windows\System32\drivers\MoriyaStreamWatchmen.sys. Creating or dropping a driver into the Windows drivers directory is a common persistence and privilege-escalation technique because it can enable low-level system control. The detection relies on Windows file event telemetry that records file creations and the exact target path/filename.
references:
  - https://securelist.com/operation-tunnelsnake-and-moriya-rootkit/101831
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Malware/Moriya-Rootkit/file_event_win_moriya_rootkit.yml
author: Bhabesh Raj, Huntrule Team
date: 2021-05-06
modified: 2023-05-05
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1543.003
  - detection.emerging-threats
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename: C:\Windows\System32\drivers\MoriyaStreamWatchmen.sys
  condition: selection
falsepositives:
  - Unknown
level: critical
license: DRL-1.1