Potential LSASS Credential Dumping via KslD Driver

[rule]
description = """
Identifies requests to the Microsoft Defender KslD driver using an IOCTL that exposes unrestricted kernel and physical
memory reads. Adversaries may abuse a vulnerable version of this signed driver to bypass Protected Process Light and
extract credentials from LSASS memory.
"""
id = "39580aee-f9b8-4828-a4d1-91036280a7c2"
license = "Elastic License v2"
name = "Potential LSASS Credential Dumping via KslD Driver"
os_list = ["windows"]
reference = [
    "https://github.com/andreisss/KslDump",
    "https://blog.fndsec.net/2026/04/16/ksld-sys-weaponizing-windows-defenders-own-signed-driver/",
]
version = "1.0.1"

query = '''
api where
  process.Ext.api.name == "DeviceIoControl" and process.pid != 4 and 
  process.Ext.api.parameters.device == "\\Device\\KslD" and
  /* IOCTL 0x222044 provides access to KslD subcommands for kernel and physical memory reads */
  process.Ext.api.parameters.io_control_code == 2236484
'''

min_endpoint_version = "8.14.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1211"
name = "Exploitation for Defense Evasion"
reference = "https://attack.mitre.org/techniques/T1211/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1003"
name = "OS Credential Dumping"
reference = "https://attack.mitre.org/techniques/T1003/"
[[threat.technique.subtechnique]]
id = "T1003.001"
name = "LSASS Memory"
reference = "https://attack.mitre.org/techniques/T1003/001/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "8.14.0"