Driverquery Lookup

calendar Jan 9, 2023 · attack.discovery attack.t1082  ·
Share on: linkedin copy

Detects use of driverquery to look up the installed and configured drivers as part of host discovery

Sigma rule (View on GitHub)

 1title: Driverquery Lookup
 2id: 94751fb0-d329-4d3f-ae80-2b8b268e925f
 3status: Experimental
 4description: Detects use of driverquery to look up the installed and configured drivers as part of host discovery
 5author: _pete_0, TheDFIRReport
 6references:
 7  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/driverquery
 8  - https://thedfirreport.com/2023/01/09/unwrapping-ursnifs-gifts
 9date: 2023/01/08
10logsource:
11  category: process_creation
12  product: windows
13detection:
14  selection:
15    Image|endswith:
16      - '\driverquery.exe'
17    CommandLine|contains:
18      - 'driverquery'
19    ParentImage|endswith:
20      - '\cmd.exe'
21    ParentCommandLine|contains:
22      - '/c'
23  condition: selection
24fields:
25  - CommandLine
26  - ParentCommandLine
27falsepositives:
28  - Administrators, helpdesk
29level: high
30tags:
31  - attack.discovery
32  - attack.t1082

References

  • driverquery

    Reference article for the driverquery command, which enables an administrator to display a list of installed device drivers and their properties.


    Read More

  • Unwrapping Ursnifs Gifts

    In late August 2022, we investigated an incident involving Ursnif malware, which resulted in Cobalt Strike being deployed. This was followed by the threat actors moving laterally throughout the env…


    Read More

Related rules

to-top