AN1595
Analytic 1595
Windows
Monitor for suspicious usage of driver enumeration utilities (driverquery.exe) or API calls such as EnumDeviceDrivers(). Registry queries against HKLM\SYSTEM\CurrentControlSet\Services and HardwareProfiles that are abnormal may also indicate attempts to discover installed drivers and services. Correlate command execution, process creation, and registry access to build a behavioral chain of driver discovery.
WinEventLog:Security
EventCode=4688
WinEventLog:Sysmon
EventCode=13, 14
[AllowedUtilities]
Whitelist expected administrative usage of driverquery.exe or other enumeration utilities.
[TimeWindow]
Correlation window between process creation and registry queries to identify suspicious chaining of events.
AN1596
Analytic 1596
Linux
Detect attempts to enumerate kernel modules through lsmod, modinfo, or inspection of /proc/modules and /dev entries. Focus on unusual execution contexts such as unprivileged users or processes outside expected administrative workflows.
auditd:SYSCALL
execve: Execution of lsmod, modinfo, or cat /proc/modules
auditd:FS
read: File access to /proc/modules or /sys/module/
[KnownAdminUsers]
Limit detection noise by filtering expected kernel module inspection by root or system maintenance scripts.
AN1597
Analytic 1597
macOS
Detect loading or inspection of kernel extensions (kextstat, kextfind) and file access to /System/Library/Extensions/. Monitor unexpected usage of these utilities by non-administrative users or scripts.
macos:unifiedlog
exec: Execution of kextstat, kextfind, or ioreg targeting driver information
macos:unifiedlog
read: File access to /System/Library/Extensions/ or related kernel extension paths
[AllowedMaintenanceTasks]
Tune detection by excluding expected system diagnostic or patch-related invocations of kext utilities.