Beyond Stuxnet: Detecting 'Fast16' Sabotage Malware and Legacy ICS Threats

---
title: Potential Fast16-Style Sabotage Kernel Driver Load
id: a1b2c3d4-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects the loading of unsigned or suspicious kernel drivers, a common TTP for ICS sabotage malware like Fast16 and Stuxnet to hide processes and manipulate file systems.
references:
  - https://attack.mitre.org/techniques/T1014/
author: Security Arsenal
date: 2025/04/08
tags:
  - attack.privilege_escalation
  - attack.t1014
logsource:
  category: driver_load
  product: windows
detection:
  selection:
    Signed: 'false'
    ImageLoaded|endswith:
      - '.sys'
  filter_legit:
    # Filter common hypervisor drivers often found in ICS labs
    ImageLoaded|contains:
      - '\vmware\'
      - '\virtualbox\'
      - '\virtio\'
  condition: selection and not filter_legit
falsepositives:
  - Legacy hardware drivers that are unsigned but authorized
level: high
---
title: ICS Project File Modification via System Process
id: b2c3d4e5-6f7a-8b9c-0d1e-2f3a4b5c6d7e
status: experimental
description: Detects modification of ICS project files (e.g., Step7 .s7p, .awl) by system processes or unusual parent processes, indicative of code injection or sabotage.
references:
  - https://attack.mitre.org/techniques/T1566/001/
author: Security Arsenal
date: 2025/04/08
tags:
  - attack.initial_access
  - attack.t1566.001
logsource:
  category: file_change
  product: windows
detection:
  selection_target:
    TargetFilename|contains:
      - '.s7p'
      - '.awl'
      - '.hap'
      - '.pd_'
  selection_process:
    Image|endswith:
      - '\lsass.exe'
      - '\svchost.exe'
      - '\explorer.exe'
  condition: all of selection_*
falsepositives:
  - Legitimate software updates or project backups
level: critical

// Hunt for unsigned drivers loaded in memory
DeviceImageLoadEvents
| where FileName endswith ".sys"
| where isnull(Signer) or Signer != "Microsoft Windows Verification Publisher"
| where InitiatingProcessFileName != "vmwareuser.exe" // Exclude common hypervisor noise
| project Timestamp, DeviceName, FileName, FolderPath, Signer, SHA256, InitiatingProcessFileName, InitiatingProcessAccountName
| order by Timestamp desc


// Monitor for modifications to ICS project directories
DeviceFileEvents
| where ActionType in ("FileCreated", "FileModified", "FileRenamed")
| where FolderPath contains "Siemens" or FolderPath contains "Step7" or FileName has_any(@".s7p", @".awl", @".pnl")
| project Timestamp, DeviceName, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessAccountName, ActionType
| order by Timestamp desc

-- Hunt for unsigned drivers loaded in the kernel
SELECT Name, DeviceName, Company, SignedStatus
FROM drivers()
WHERE SignedStatus != "Signed" OR SignedStatus = "Unsigned"
-- Exclude common hypervisor drivers to reduce noise in virtual environments
AND Name NOT =~ "vmci"
AND Name NOT =~ "vmx_svga"
AND Name NOT =~ "VBoxMouse"

<#
    .SYNOPSIS
    Audit ICS Workstation for Unsigned Drivers and Suspicious Kernel Modules.
    .DESCRIPTION
    This script identifies unsigned drivers loaded in the kernel, which is a primary
    vector for Fast16-style sabotage malware. It requires Administrator privileges.
#>

# Check for Administrator privileges
if (-not ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator")) {
    Write-Warning "You must run this script as an Administrator."
    exit
}

Write-Host "[+] Enumerating loaded kernel drivers..." -ForegroundColor Cyan

$suspiciousDrivers = Get-WmiObject Win32_SystemDriver | Where-Object { 
    $_.State -eq "Running" -and 
    $_.StartMode -eq "Auto" -and
    ($_.DisplayName -notmatch "Microsoft|Windows|Intel|NVIDIA|AMD|Realtek")
}

if ($suspiciousDrivers) {
    Write-Host "[!] ALERT: Found potentially suspicious running drivers:" -ForegroundColor Red
    $suspiciousDrivers | Format-Table Name, DisplayName, PathName, StartMode -AutoSize
    
    # Optional: Dump driver hashes for analysis
    $suspiciousDrivers | ForEach-Object {
        if (Test-Path $_.PathName) {
            Write-Host "[+] Hashing driver: $($_.PathName)"
            Get-FileHash -Path $_.PathName -Algorithm SHA256 | Format-List
        }
    }
} else {
    Write-Host "[-] No obviously suspicious drivers found based on name filters." -ForegroundColor Green
}

Write-Host "[+] Checking for Stuxnet/Fast16 associated registry keys (e.g., MRXCLS, MRXNET)..." -ForegroundColor Cyan
$regPaths = @(
    "HKLM\SYSTEM\CurrentControlSet\Services\MRXCLS",
    "HKLM\SYSTEM\CurrentControlSet\Services\MRXNET",
    "HKLM\SYSTEM\CurrentControlSet\Services\GPDClass"
)

foreach ($path in $regPaths) {
    if (Test-Path $path) {
        Write-Host "[!!!] CRITICAL: Suspicious service key found at $path" -ForegroundColor Red
    } else {
        Write-Host "[-] No malicious key found at $path" -ForegroundColor Gray
    }
}