fast16 Malware Framework: Historical ICS Sabotage Analysis and Defensive Hunt

---
title: Potential ICS Rootkit Driver Load
id: 8a4b9c12-3d5e-4f6a-9b1c-2d3e4f5a6b7c
status: experimental
description: Detects the loading of drivers from non-standard paths or drivers lacking valid digital signatures, a common TTP for early ICS rootkits like fast16.
references:
  - https://attack.mitre.org/techniques/T1014/
author: Security Arsenal
date: 2025/04/09
tags:
  - attack.privilege_escalation
  - attack.t1014
logsource:
  category: driver_load
  product: windows
detection:
  selection:
    Signed: 'false'
  condition: selection
falsepositives:
  - Legacy hardware drivers for specialized test equipment
level: high
---
title: Suspicious Process Access to SCADA Software
id: 9c5d0a23-4e6f-5g7h-0i1j-2k3l4m5n6o7p
status: experimental
description: Detects non-system processes accessing the memory of known ICS engineering software, indicative of framework injection capabilities.
references:
  - https://attack.mitre.org/techniques/T1055/
author: Security Arsenal
date: 2025/04/09
tags:
  - attack.defense_evasion
  - attack.t1055
logsource:
  category: process_access
  product: windows
detection:
  selection_target:
    TargetImage|contains:
      - '\WinCC'
      - '\Step7'
      - '\RSView'
      - '\FactoryTalk'
  selection_grant:
    GrantedAccess|contains:
      - 'PROCESS_VM_WRITE'
      - 'PROCESS_VM_OPERATION'
  filter_generic:
    SourceImage|contains:
      - '\Program Files\'
      - '\Program Files (x86)\'
  condition: selection_target and selection_grant and not filter_generic
falsepositives:
  - Legitimate debugging by ICS engineers
level: medium


**KQL (Microsoft Sentinel / Defender)**

// Hunt for unsigned drivers loaded in the last 7 days, potentially indicating legacy rootkits
DeviceEvents
| where Timestamp > ago(7d)
| where ActionType == "DriverLoad"
| where isnotempty(AdditionalFields)
| extend DriverSigned = tostring(AdditionalFields.[Signed])
| where DriverSigned =~ "false" or DriverSigned =~ "unknown"
| project Timestamp, DeviceName, InitiatingProcessAccountName, FileName, FolderPath, SHA256
| sort by Timestamp desc


**Velociraptor VQL**

-- Hunt for drivers that are not signed or have invalid signatures
SELECT *
FROM read_reg_key(glob="HKLM\SYSTEM\CurrentControlSet\Services\*")
WHERE
  -- Look for Type 1 (Kernel) or Type 2 (File System) drivers
  Data.Type == 1 OR Data.Type == 2
  -- Exclude standard Microsoft paths to reduce noise
  AND NOT Data.ImagePath =~ "C:\\Windows\\System32\\drivers\\"
  AND NOT Data.ImagePath =~ "C:\\Windows\\System32\\DriverStore\\"


**Remediation Script (PowerShell)**

<#
.SYNOPSIS
    Audit and Block Unsigned Drivers to mitigate legacy rootkit risks.
.DESCRIPTION
    This script checks the Code Integrity policy status and identifies
    currently loaded unsigned drivers for investigation.
#>

Write-Host "[+] Auditing loaded unsigned drivers..."

$unsignedDrivers = Get-WmiObject Win32_SystemDriver | `n    Where-Object { $_.State -eq "Running" -and `n    ($_.AcceptStop -eq $false -or $_.AcceptPause -eq $false) } | `n    ForEach-Object {
        $sig = Get-AuthenticodeSignature $_.PathName
        if ($sig.Status -ne "Valid") {
            $_
        }
    }

if ($unsignedDrivers) {
    Write-Host "[!] WARNING: Unsigned drivers found:" -ForegroundColor Red
    $unsignedDrivers | Select-Object DisplayName, PathName, Started | Format-Table -AutoSize
} else {
    Write-Host "[*] No unsigned drivers currently detected." -ForegroundColor Green
}

Write-Host "[+] Checking Driver Signing Policy via CI Policy..."
$ciPolicy = Get-SystemDriverPolicy 2>$null
if (-not $ciPolicy) {
    Write-Host "[!] No strict Code Integrity Policy detected. Consider deploying WDAC." -ForegroundColor Yellow
} else {
    Write-Host "[*] Code Integrity Policy is active." -ForegroundColor Green
}