Detect CVE-2024-26234 — Windows Proxy Driver Spoofing via Malicious Signed Driver in Sumo Logic CSE
Detects exploitation of CVE-2024-26234, a Windows Proxy Driver Spoofing vulnerability where threat actors abuse Microsoft's WHQL signing process to load a malicious signed kernel driver. The driver installs a proxy component enabling persistent backdoor access. Severity is elevated given weaponized exploit status and kernel-level code execution potential.
MITRE ATT&CK
Sumo Detection Query
_sourceCategory=windows/security OR _sourceCategory=windows/sysmon
| where EventID in ("7045", "6") or EventType = "DriverLoad"
| parse regex field=_raw "(?<driver_path>[A-Za-z]:\\\\[^\"<>|?*]+\.sys)" nodrop
| parse regex field=_raw "(?i)(?:SignerName|SubjectName)=\"(?<cert_signer>[^\"]+)\"" nodrop
| where isNull(cert_signer) OR cert_signer matches "*Microsoft*" OR cert_signer matches "*Windows*"
| where !isNull(driver_path)
| timeslice 5m
| count by _timeslice, _sourceHost, driver_path, cert_signer, EventID
| join
[
_sourceCategory=windows/sysmon EventID=3
| where DestinationPort in ("1080", "3128", "8080", "8443", "443")
| parse field=_raw "Image=(?<initiating_process>[^\r\n]+)" nodrop
| where initiating_process matches "*.sys"
| timeslice 5m
| count by _timeslice, _sourceHost, initiating_process, DestinationIp, DestinationPort
] on _timeslice, _sourceHost
| project _timeslice, _sourceHost, driver_path, cert_signer, initiating_process, DestinationIp, DestinationPort
| sort by _timeslice descCorrelates Windows driver installation and Sysmon network connection events to identify Microsoft-signed .sys files making outbound proxy connections, indicative of CVE-2024-26234.
Data Sources
False Positives & Tuning
- Legitimate remote access products using signed kernel components
- Sumo Logic's own collection agents if kernel-level
- Corporate proxy agents installed as kernel drivers
- Vulnerability scanners triggering driver loads during assessment
Other platforms for CVE-2024-26234
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Deploy a self-signed WHQL-mimicking kernel driver
Expected signal: Windows Security Event ID 7045 (service install) with ServiceType=kernel, Sysmon Event ID 6 (driver load) with ImageLoaded path in ProgramData, and Code Integrity event in Microsoft-Windows-CodeIntegrity/Operational log.
- Test 2Simulate proxy connection from a .sys-named process
Expected signal: Sysmon Event ID 3 (network connection) with Image path ending in .sys, destination ports 1080 and 8080, and non-loopback destination IP.
- Test 3Extract and inspect driver certificate chain for WHQL abuse indicators
Expected signal: Process creation event for sigcheck64.exe with command line referencing the driver path. Output file creation in C:\Temp\.
- Test 4Registry persistence check for kernel driver service entry
Expected signal: Sysmon Event ID 13 (registry value set) for HKLM\SYSTEM\CurrentControlSet\Services\SimProxyDrv\ImagePath with a value pointing to a non-standard driver path, and Windows Security Event ID 4657 (registry value modified) if object access auditing is enabled.
Response Playbook
Triage
- Identify the specific .sys driver file: capture full path, file hash (SHA256/MD5), and digital signature details including the exact certificate chain to determine if it matches the abused Microsoft WHQL signature observed in CVE-2024-26234 campaigns.
- Enumerate all services and scheduled tasks created or modified within 48 hours of the driver load event on the affected host, focusing on entries that reference the suspicious .sys file or parent directories.
- Review outbound network connections from the driver process: resolve destination IPs against threat intel feeds (VirusTotal, Shodan), check for C2 registration patterns, and examine any proxy CONNECT tunnels established through the driver.
- Assess blast radius by querying EDR telemetry for the same driver hash or certificate thumbprint across the enterprise fleet to determine if this is an isolated incident or active lateral spread.
- Check the Microsoft MSRC advisory and April 2024 Patch Tuesday status for the affected host — confirm whether KB5036893 (or equivalent cumulative update) has been applied.
Containment
- Isolate the affected host from the network immediately using EDR network containment or VLAN isolation to prevent the proxy backdoor from exfiltrating data or receiving further attacker commands while forensic triage proceeds.
- Block the malicious driver's SHA256 hash and certificate thumbprint at the endpoint via Windows Defender Application Control (WDAC) policy or CrowdStrike custom IOA, and push the block policy fleet-wide to prevent execution on additional hosts.
- Revoke or block the attacker's known C2 IP addresses and domains at the perimeter firewall and DNS layer based on network IOCs extracted during triage.
Evidence Collection
- Acquire a full memory image of the affected host using WinPmem or CrowdStrike RTR memory acquisition before rebooting, preserving in-memory driver artifacts, loaded kernel modules, and any decrypted proxy configuration.
- Collect the malicious .sys file and all files in its parent directory, preserving original timestamps (MACE) via forensic copy. Submit the binary to a sandboxed malware analysis environment and to Microsoft MSRC for analysis.
- Extract Windows Security Event Logs (7045 service install, 4697 service install, 4688 process creation), Sysmon logs, and Prefetch files covering the 72-hour window before detection to reconstruct the full infection chain.
Escalation Criteria
- !Escalate to CISO and incident commander if the driver hash is detected on more than 3 hosts, indicating active lateral movement or a supply-chain-style deployment rather than a single targeted compromise.
- !Escalate immediately if the affected host is a domain controller, PKI server, credential store, or hosts privileged accounts — kernel-level access on these systems implies full domain compromise potential.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Registry key HKLM\SYSTEM\CurrentControlSet\Services\<driver_name> containing ImagePath pointing to the malicious .sys file - >
Windows Event ID 7045 (new service installed) with ServiceType=kernel and ServiceFileName matching the malicious driver path - >
Code Integrity event log (Microsoft-Windows-CodeIntegrity/Operational) entries for the driver load with signing certificate details - >
Prefetch file for the installer binary (if delivered via a dropper) at C:\Windows\Prefetch\ - >
Scheduled task XML in C:\Windows\System32\Tasks\ if the dropper created a persistence mechanism - >
MFT entries ($MFT) for the .sys file creation timestamp, which may differ from file system timestamps if the attacker manipulated MACE attributes
Tuning Guidance
Start by whitelisting known-good Microsoft-signed drivers loaded from C:\Windows\System32\drivers\ and major security vendor directories (CrowdStrike, Sophos, etc.) by their SHA256 hash and parent directory path. The highest-fidelity signal is a .sys file loaded from a user-writable directory (Temp, AppData, ProgramData) with a valid Microsoft WHQL signature — this combination should have near-zero false positive rate and can be promoted to high confidence. Reduce noise on the network correlation leg by excluding known Microsoft IP ranges (ASN 8075) and software update endpoints. If Sysmon Driver Load events (Event ID 6) are available, prefer them over Security Event 7045 as they capture more certificate metadata. Consider creating a baseline of all kernel drivers in your environment and alerting only on first-seen hashes.
Hunting Queries
Hunt for Microsoft-signed kernel drivers loaded from non-standard directories (outside System32\drivers and Program Files), which is a strong indicator of a malicious signed driver like those used in CVE-2024-26234.
DeviceEvents
| where ActionType == "DriverLoad"
| join kind=inner (
DeviceFileCertificateInfo
| where Signer contains "Microsoft"
| where IsTrusted == true
| project SHA256, Signer, SignerHash, CertificateCreationTime
) on SHA256
| where FolderPath !startswith "C:\\Windows\\System32\\drivers\\"
and FolderPath !startswith "C:\\Windows\\SysWOW64\\"
and FolderPath !startswith "C:\\Program Files\\"
| project Timestamp, DeviceId, DeviceName, FileName, FolderPath, SHA256, Signer, CertificateCreationTime
| order by Timestamp descindex=windows (EventCode=7045 OR EventCode=4697)
| eval ServiceFileName=lower(ServiceFileName)
| where match(ServiceFileName, "\.sys$")
| where NOT match(ServiceFileName, "(?i)windows\\\\system32\\\\drivers")
| where NOT match(ServiceFileName, "(?i)program files")
| eval signer=lower(coalesce(SignerName, "unknown"))
| where signer like "%microsoft%" OR signer="unknown"
| stats count, values(ServiceFileName) as drivers, values(ComputerName) as hosts by signer
| sort -countAtomic Red Team Tests
Simulates the driver installation phase of CVE-2024-26234 by installing a benign test .sys driver from a non-standard path using sc.exe, mimicking how the malicious proxy driver would be registered as a kernel service.
Command
# LAB ONLY — requires test-signed driver and test signing mode
# Enable test signing: bcdedit /set testsigning on && shutdown /r /t 0
copy C:\Users\Public\test_driver.sys C:\ProgramData\test_driver.sys
sc create TestProxyDrv type= kernel binPath= C:\ProgramData\test_driver.sys start= demand
sc start TestProxyDrvCleanup
sc stop TestProxyDrv
sc delete TestProxyDrv
del C:\ProgramData\test_driver.sys
bcdedit /set testsigning offExpected Telemetry
Windows Security Event ID 7045 (service install) with ServiceType=kernel, Sysmon Event ID 6 (driver load) with ImageLoaded path in ProgramData, and Code Integrity event in Microsoft-Windows-CodeIntegrity/Operational log.
Expected Detection
Detection should fire on the KQL, SPL, and EQL queries matching a driver load from a non-standard path. The CrowdStrike CQL rule should also generate a DriverLoad event alert.
Tests the network detection component by launching a process named with a .sys extension that makes outbound connections to proxy ports, validating that SIEM queries correctly identify kernel driver network activity.
Command
# LAB ONLY — simulates network behavior signature
copy C:\Windows\System32\curl.exe C:\Temp\fakenet.sys
C:\Temp\fakenet.sys -x socks5://127.0.0.1:1080 http://example.com --max-time 5 --silent
C:\Temp\fakenet.sys http://example.com:8080 --max-time 5 --silentCleanup
del C:\Temp\fakenet.sysExpected Telemetry
Sysmon Event ID 3 (network connection) with Image path ending in .sys, destination ports 1080 and 8080, and non-loopback destination IP.
Expected Detection
Network-side correlation queries (SPL, Sumo Logic, QRadar AQL) should alert on outbound connections from .sys-named processes to proxy ports.
Validates forensic artifact collection by using sigcheck to extract and log the complete certificate chain of a driver binary, simulating what investigators would do to confirm CVE-2024-26234 certificate abuse.
Command
# Download Sysinternals sigcheck (lab environment)
# sigcheck64.exe -accepteula available from https://learn.microsoft.com/sysinternals
sigcheck64.exe -accepteula -v C:\Windows\System32\drivers\Ntfs.sys > C:\Temp\driver_cert_baseline.txt
# Replace with suspicious driver path in real investigation:
# sigcheck64.exe -accepteula -v C:\ProgramData\suspect_driver.sysCleanup
del C:\Temp\driver_cert_baseline.txtExpected Telemetry
Process creation event for sigcheck64.exe with command line referencing the driver path. Output file creation in C:\Temp\.
Expected Detection
No direct detection expected for this investigative step — validates the forensic artifact collection procedure described in the playbook's evidenceCollection steps.
Validates detection of the registry persistence mechanism used by the CVE-2024-26234 driver by creating a simulated kernel service registry key in a lab environment, exercising registry-based hunting queries.
Command
# LAB ONLY — creates benign registry key mimicking driver service persistence
reg add "HKLM\SYSTEM\CurrentControlSet\Services\SimProxyDrv" /v ImagePath /t REG_EXPAND_SZ /d "\??\C:\ProgramData\sim_proxy.sys" /f
reg add "HKLM\SYSTEM\CurrentControlSet\Services\SimProxyDrv" /v Type /t REG_DWORD /d 1 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Services\SimProxyDrv" /v Start /t REG_DWORD /d 3 /f
reg query "HKLM\SYSTEM\CurrentControlSet\Services\SimProxyDrv"Cleanup
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\SimProxyDrv" /fExpected Telemetry
Sysmon Event ID 13 (registry value set) for HKLM\SYSTEM\CurrentControlSet\Services\SimProxyDrv\ImagePath with a value pointing to a non-standard driver path, and Windows Security Event ID 4657 (registry value modified) if object access auditing is enabled.
Expected Detection
Hunting queries filtering on service registry keys with ImagePath values outside System32\drivers\ should surface this entry.