Lunex MaaS BYOVD Campaign Targeting Ukraine: Kernel Callback Manipulation via AMD PDFWKRNL.sys (CVE-2023-20598) — OTX Detection Pack

---
title: Vulnerable AMD PDFWKRNL Driver Load - BYOVD LunexLoader
id: 7c1a2e4d-3b8f-4a1e-9d2c-5f6e7a8b9c01
status: experimental
description: Detects loading of the AMD PDFWKRNL.sys driver abused by LunexLoader via CVE-2023-20598 for BYOVD kernel callback manipulation. Alert on any load of this driver on non-AMD systems or from non-standard paths.
author: Security Arsenal Threat Intelligence
references:
  - https://blog.polyswarm.io/lunex-uses-byovd-to-disable-security-monitoring-and-deploy-persistent-stealer
  - https://www.cve.org/CVERecord?id=CVE-2023-20598
date: 2026/10/06
logsource:
  category: driver_load
  product: windows
detection:
  selection_name:
    ImageLoaded|endswith: '\pdfwkrnl.sys'
  filter_amd_legit:
    ImageLoaded: 'C:\Windows\System32\drivers\PDFWKRNL.sys'
  condition: selection_name and not filter_amd_legit
falsepositives:
  - Legitimate AMD platform driver installations on AMD hardware (tune filter to hardware inventory)
level: high
tags:
  - attack.defense_evasion
  - attack.t1068
  - attack.t1562.001
---
title: Kernel Symbol Download From Microsoft Symbol Server By Non-Debug Process
id: 8d2b3f5e-4c9a-5b2f-ae3d-6a7f8b9c0d12
status: experimental
description: Detects processes other than legitimate debuggers retrieving kernel PDB symbols from Microsoft's Symbol Server - a technique used by LunexLoader to resolve and zero EDR kernel callbacks.
author: Security Arsenal Threat Intelligence
references:
  - https://blog.polyswarm.io/lunex-uses-byovd-to-disable-security-monitoring-and-deploy-persistent-stealer
date: 2026/10/06
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
  selection_cl:
    CommandLine|contains:
      - 'msdl.microsoft.com'
      - 'download/symbols'
      - 'ntkrnlmp.pdb'
      - 'ntoskrnl.pdb'
  condition: all of selection_*
falsepositives:
  - Rare; legitimate symbol downloads are typically performed by windbg.exe, kd.exe, or symchk.exe which are excluded from the image list
level: high
tags:
  - attack.defense_evasion
  - attack.t1562.001
  - attack.t1027
---
title: Suspicious Browser Native Messaging Host Registration - LunexStealer Persistence
id: 9e3c4a6f-5d0b-6c3a-bf4e-7b8a9c0d1e23
status: experimental
description: Detects creation or modification of browser Native Messaging Host registry keys and manifest files by non-browser processes, a persistence mechanism used by LunexStealer.
author: Security Arsenal Threat Intelligence
references:
  - https://blog.polyswarm.io/lunex-uses-byovd-to-disable-security-monitoring-and-deploy-persistent-stealer
date: 2026/10/06
logsource:
  category: registry_set
  product: windows
detection:
  selection_key:
    TargetObject|contains:
      - '\Google\Chrome\NativeMessagingHosts\'
      - '\Microsoft\Edge\NativeMessagingHosts\'
      - '\Mozilla\NativeMessagingHosts\'
  filter_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\msiexec.exe'
  condition: selection_key and not filter_browsers
falsepositives:
  - Enterprise software installers registering legitimate native messaging hosts (password managers, SSO agents) - baseline and whitelist per environment
level: medium
tags:
  - attack.persistence
  - attack.t1176
  - attack.t1546

// Lunex Campaign Hunt: BYOVD driver load + symbol server retrieval + native messaging persistence
// Microsoft Sentinel / Defender XDR - run across last 30 days
let VulnDrivers = dynamic(["pdfwkrnl.sys"]);
let SymbolHosts = dynamic(["msdl.microsoft.com"]);
union isfuzzy=true
(DeviceEvents
 | where TimeGenerated > ago(30d)
 | where ActionType == "DriverLoad" or (ActionType == "FileCreated" and FileName has_any (VulnDrivers))
 | where FileName has_any (VulnDrivers) or FolderPath has "pdfwkrnl"
 | project TimeGenerated, DeviceName, ActionType, FileName, FolderPath, SHA256, InitiatingProcessFileName, InitiatingProcessCommandLine),
(DeviceNetworkEvents
 | where TimeGenerated > ago(30d)
 | where RemoteUrl has_any (SymbolHosts) and RemoteUrl has "symbols"
 | where InitiatingProcessFileName !in~ ("windbg.exe","kd.exe","symchk.exe","devenv.exe","procmon.exe","procexp.exe")
 | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP),
(DeviceRegistryEvents
 | where TimeGenerated > ago(30d)
 | where RegistryKey has "NativeMessagingHosts"
 | where InitiatingProcessFileName !in~ ("chrome.exe","msedge.exe","firefox.exe","msiexec.exe")
 | project TimeGenerated, DeviceName, ActionType, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName, InitiatingProcessCommandLine),
(DeviceProcessEvents
 | where TimeGenerated > ago(30d)
 | where ProcessCommandLine has_any ("NtLoadDriver","pdfwkrnl","\\.\\PDFWKRNL","PspCreateProcessNotifyRoutine","PspCreateThreadNotifyRoutine")
 | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName)
| sort by TimeGenerated desc

# Lunex IOC Hunt Script - Security Arsenal Threat Intelligence
# Checks for: vulnerable AMD driver presence, native messaging persistence, stealer wallet-target artifacts
# Run elevated on endpoints; output JSON per host for SIEM ingestion.

$report = [ordered]@{ Host = $env:COMPUTERNAME; Time = (Get-Date -Format o); Findings = @() }

# 1. BYOVD: hunt for PDFWKRNL.sys anywhere on disk + loaded driver check
$driverHits = Get-ChildItem -Path "C:\Windows","C:\Users","C:\ProgramData" -Recurse -Filter "pdfwkrnl.sys" -ErrorAction SilentlyContinue
foreach ($d in $driverHits) {
    $hash = (Get-FileHash $d.FullName -Algorithm SHA256).Hash
    $report.Findings += [ordered]@{ Type="BYOVD_Driver"; Path=$d.FullName; SHA256=$hash; Severity="Critical" }
}
$loaded = Get-CimInstance Win32_SystemDriver -ErrorAction SilentlyContinue | Where-Object { $_.PathName -match "pdfwkrnl" }
if ($loaded) { $report.Findings += [ordered]@{ Type="BYOVD_Driver_Loaded"; Path=$loaded.PathName; State=$loaded.State; Severity="Critical" } }

# 2. Persistence: suspicious Native Messaging Host registrations
$nmhRoots = @(
  "HKCU:\Software\Google\Chrome\NativeMessagingHosts",
  "HKCU:\Software\Microsoft\Edge\NativeMessagingHosts",
  "HKCU:\Software\Mozilla\NativeMessagingHosts",
  "HKLM:\Software\Google\Chrome\NativeMessagingHosts"
)
foreach ($root in $nmhRoots) {
    if (Test-Path $root) {
        Get-ChildItem $root -ErrorAction SilentlyContinue | ForEach-Object {
            $manifest = (Get-ItemProperty $_.PSPath).'(default)'
            if ($manifest -and (Test-Path $manifest -ErrorAction SilentlyContinue)) {
                $m = Get-Content $manifest -Raw -ErrorAction SilentlyContinue
                $report.Findings += [ordered]@{ Type="NativeMessagingHost"; Key=$_.PSPath; Manifest=$manifest; Content=$m; Severity="Medium" }
            }
        }
    }
}

# 3. Stealer targeting: crypto wallet extension data recently accessed/copied (heuristic)
$walletPaths = @("$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn") # MetaMask
foreach ($w in $walletPaths) {
    if (Test-Path $w) {
        $recent = Get-ChildItem $w -Recurse -ErrorAction SilentlyContinue | Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-7) }
        if ($recent) { $report.Findings += [ordered]@{ Type="WalletData_RecentModification"; Path=$w; Files=($recent.FullName -join ";"); Severity="High" } }
    }
}

# 4. Symbol server retrieval artifacts in DNS cache
$dns = Get-DnsClientCache -ErrorAction SilentlyContinue | Where-Object { $_.Entry -match "msdl.microsoft.com" }
if ($dns) { $report.Findings += [ordered]@{ Type="SymbolServer_DNS"; Entries=($dns.Entry -join ";"); Severity="High" } }

$report | ConvertTo-Json -Depth 5