T1652 - Device Driver Discovery
Description from ATT&CK (opens in a new tab)
Adversaries may attempt to enumerate local device drivers on a victim host. Information about device drivers may highlight various insights that shape follow-on behaviors, such as the function/purpose of the host, present security tools (i.e. Security Software Discovery (opens in a new tab)) or other defenses (e.g., Virtualization/Sandbox Evasion (opens in a new tab)), as well as potential exploitable vulnerabilities (e.g., Exploitation for Privilege Escalation (opens in a new tab)).
Many OS utilities may provide information about local device drivers, such as
driverquery.exe
and theEnumDeviceDrivers()
API function on Windows.(Citation: Microsoft Driverquery)(Citation: Microsoft EnumDeviceDrivers) Information about device drivers (as well as associated services, i.e., System Service Discovery (opens in a new tab)) may also be available in the Registry.(Citation: Microsoft Registry Drivers)On Linux/macOS, device drivers (in the form of kernel modules) may be visible within
/dev
or using utilities such aslsmod
andmodinfo
.(Citation: Linux Kernel Programming)(Citation: lsmod man)(Citation: modinfo man)
Atomic Tests
Atomic Test #1 - Device Driver Discovery
Displays a list of installed device drivers on the local computer and their properties. Threat actors use this command to enumerate the existing drivers on the computer. Parameters: /v /fo list - Displays verbose output in a list format - the /v parameter is not valid for signed drivers /si /fo list - Provides information about signed drivers and outputs it in a list format
Supported Platforms: Windows
auto_generated_guid: 235b30a2-e5b1-441f-9705-be6231c88ddd
Attack Commands: Run with powershell
!
driverquery /v /fo list
driverquery /si /fo list