Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in User Guide
Log in Get started
Detection Strategies DET0579 — Detection Strategy for Device Driver Discovery
DET0579

Detection Strategy for Device Driver Discovery

3 analytic(s) · 1 technique(s) detected

Analytics

3
AN1595 Analytic 1595
Windows

Monitor for suspicious usage of driver enumeration utilities (driverquery.exe) or API calls such as EnumDeviceDrivers(). Registry queries against HKLM\SYSTEM\CurrentControlSet\Services and HardwareProfiles that are abnormal may also indicate attempts to discover installed drivers and services. Correlate command execution, process creation, and registry access to build a behavioral chain of driver discovery.

WinEventLog:Security EventCode=4688 WinEventLog:Sysmon EventCode=13, 14
[AllowedUtilities] Whitelist expected administrative usage of driverquery.exe or other enumeration utilities.
[TimeWindow] Correlation window between process creation and registry queries to identify suspicious chaining of events.
AN1596 Analytic 1596
Linux

Detect attempts to enumerate kernel modules through lsmod, modinfo, or inspection of /proc/modules and /dev entries. Focus on unusual execution contexts such as unprivileged users or processes outside expected administrative workflows.

auditd:SYSCALL execve: Execution of lsmod, modinfo, or cat /proc/modules auditd:FS read: File access to /proc/modules or /sys/module/
[KnownAdminUsers] Limit detection noise by filtering expected kernel module inspection by root or system maintenance scripts.
AN1597 Analytic 1597
macOS

Detect loading or inspection of kernel extensions (kextstat, kextfind) and file access to /System/Library/Extensions/. Monitor unexpected usage of these utilities by non-administrative users or scripts.

macos:unifiedlog exec: Execution of kextstat, kextfind, or ioreg targeting driver information macos:unifiedlog read: File access to /System/Library/Extensions/ or related kernel extension paths
[AllowedMaintenanceTasks] Tune detection by excluding expected system diagnostic or patch-related invocations of kext utilities.

Detected Techniques

1

Details

MITRE ID
DET0579
STIX ID
x-mitre-detection-strategy--ff6c2db6-cc1b-47e0-89a6-536f83b74906
Analytics
3
Techniques Detected
1
By Tactic
Discovery
1
Leaving Threaticon

This link opens an external site that isn't part of the platform.