ValleyRAT Exploiting BYOVD
This KQL query is designed to detect a key technique used in the Valley RAT campaign, as detailed in the HexaStrike blog post. The rule focuses on a classic "Bring Your Own Vulnerable Driver" (BYOVD) attack method where an attacker installs a malicious driver or executable as a new service to achieve persistence and high-level privileges. Detection Logic The query analyzes DeviceRegistryEvents to identify suspicious changes to Windows services: Service Path Manipulation: It specifically looks for modifications to the ImagePath registry value. This value tells Windows which file to execute when a service starts. Suspicious Locations: The core of the detection is a filter for services whose ImagePath points to an unusual location, such as a temporary (%TEMP%) or program data directory (C:\ProgramData). Legitimate system drivers are almost always loaded from the C:\Windows\System32\drivers folder. Exclusions: To reduce false positives, the rule excludes known legitimate processes, like those related to Microsoft Defender, that might write to these directories. By identifying services that are configured to load files from untypical paths, this detection rule effectively uncovers a common tactic used by attackers to bypass security controls and establish a foothold on a system.
Microsoft Sentinel (KQL)
