Last Week in Threats: Week 33

This Week's Hunting Takeaway

CVE-2026-68820 is a local privilege-escalation zero-day in the Windows WinSock driver (AFD.sys) under active exploitation by the Lazarus group, with AlienVault OTX tying it to a rootkit dubbed FudModule. The attack chain typically begins with an initial compromise, followed by unsigned kernel-mode driver loads to escalate privileges, credential harvesting, and lateral movement. Hunt for unsigned driver loads in rapid succession with credential access and outbound network connections.

Hunt: Unsigned Kernel Driver Loads Followed by Credential Access

Behavior Targeted: Unsigned or untrusted kernel-mode driver loads followed by LSASS memory access or credential dumping, indicating privilege escalation paired with credential harvesting
MITRE ATT&CK: T1068 (Exploitation for Privilege Escalation), T1003 (OS Credential Dumping)
Telemetry: Sysmon (Event ID 6: driver load), Windows Defender (driver-load events), EDR process/memory-access logs
False Positive Likelihood: LOW (unsigned driver loads are rare in managed environments; the sequence is high-fidelity)

Splunk SPL Query

index=windows sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=6
| eval driver_signature=if(isnull(Signature) OR Signature="", "unsigned", "signed")
| where driver_signature="unsigned"
| transaction host maxspan=5m
| search sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=10
    TargetImage="*lsass.exe"
| table _time, host, ImageLoaded, Hashes, SourceImage, TargetImage
| sort 0 _time

Microsoft KQL Query (Defender/Sentinel)

// Unsigned driver loads followed by LSASS access within 5 minutes
let UnsignedDrivers = DeviceEvents
| where ActionType == "DriverLoad"
| where InitiatingProcessVersionInfoProductName == "" or isempty(InitiatingProcessVersionInfoProductName)
| project Timestamp, DeviceName, DriverPath=AdditionalFields.ImageLoaded, DriverHash=SHA256;
let LsassAccess = DeviceProcessEvents
| where ProcessCommandLine has "lsass" or FileName =~ "lsass.exe"
| project Timestamp, DeviceName, TargetProcess=FileName;
UnsignedDrivers
| join kind=inner (LsassAccess) on DeviceName
| where (Timestamp1 - Timestamp) between (0min .. 5min)
| project Timestamp, DeviceName, DriverPath, DriverHash, TargetProcess
| order by Timestamp desc

Note: These queries were generated with AI assistance and are a starting point, not a verdict. A query that returns no results does not mean the threat is absent. Confirm that the referenced indexes, sourcetypes, and field names exist in your environment, that the relevant data is actually being ingested, and that names match your schema (watch for spelling and naming drift). Validate against your own ingest and audit trails before drawing conclusions.