Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2024-26234.
Upgrade to ProDetect CVE-2024-26234 — Windows Proxy Driver Spoofing via Malicious Signed Driver in Splunk
Detects exploitation of CVE-2024-26234, a Windows Proxy Driver Spoofing vulnerability where threat actors abuse Microsoft's WHQL signing process to load a malicious signed kernel driver. The driver installs a proxy component enabling persistent backdoor access. Severity is elevated given weaponized exploit status and kernel-level code execution potential.
MITRE ATT&CK
SPL Detection Query
index=windows sourcetype=WinEventLog:Security EventCode=7045
| eval DriverPath=lower(ServiceFileName)
| where match(DriverPath, "\.sys$")
| eval SHA256=lower(coalesce(SHA256, "unknown"))
| join type=left SHA256 [
search index=windows sourcetype=WinEventLog:Security EventCode=7045 OR sourcetype=XmlWinEventLog:Microsoft-Windows-CodeIntegrity/Operational
| eval cert_signer=lower(coalesce(SignerName, SubjectName, "unknown"))
| where match(cert_signer, "microsoft")
| stats count by SHA256, cert_signer
]
| where cert_signer like "%microsoft%"
| join type=inner ServiceName [
search index=windows (sourcetype=WinEventLog:System OR sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational) EventCode=3
| eval process=lower(Image)
| where match(process, "\.sys$") OR DestinationPort IN ("1080","8080","8443","3128")
| stats count, values(DestinationIp) as remote_ips, values(DestinationPort) as remote_ports by Image
| rename Image as ServiceName
]
| table _time, ComputerName, ServiceName, ServiceFileName, SHA256, cert_signer, remote_ips, remote_ports
| sort -_timeCorrelates Windows service installation events for .sys drivers signed by Microsoft (Event 7045) with outbound network connections from kernel driver processes, indicating potential CVE-2024-26234 proxy backdoor deployment.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Legitimate driver update processes installing new signed kernel components
- Security software drivers with network telemetry capabilities
- Windows network stack drivers (Tcpip.sys, ndis.sys) making expected connections
- Enterprise proxy agents using kernel-level drivers for SSL inspection
Other platforms for CVE-2024-26234
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Deploy a self-signed WHQL-mimicking kernel driver
Expected signal: Windows Security Event ID 7045 (service install) with ServiceType=kernel, Sysmon Event ID 6 (driver load) with ImageLoaded path in ProgramData, and Code Integrity event in Microsoft-Windows-CodeIntegrity/Operational log.
- Test 2Simulate proxy connection from a .sys-named process
Expected signal: Sysmon Event ID 3 (network connection) with Image path ending in .sys, destination ports 1080 and 8080, and non-loopback destination IP.
- Test 3Extract and inspect driver certificate chain for WHQL abuse indicators
Expected signal: Process creation event for sigcheck64.exe with command line referencing the driver path. Output file creation in C:\Temp\.
- Test 4Registry persistence check for kernel driver service entry
Expected signal: Sysmon Event ID 13 (registry value set) for HKLM\SYSTEM\CurrentControlSet\Services\SimProxyDrv\ImagePath with a value pointing to a non-standard driver path, and Windows Security Event ID 4657 (registry value modified) if object access auditing is enabled.
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2024-26234 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month