Device Driver Discovery

Adversaries may attempt to enumerate local device drivers on a victim host. Information about device drivers may highlight various insights that shape follow-on behaviors, such as the function/purpose of the host, present security tools (i.e. Security Software Discovery) or other defenses (e.g., Virtualization/Sandbox Evasion), as well as potential exploitable vulnerabilities (e.g., Exploitation for Privilege Escalation). Many OS utilities may provide information about local device drivers, such as `driverquery.exe` and the `EnumDeviceDrivers()` API function on Windows.¹² Information about device drivers (as well as associated services, i.e., System Service Discovery) may also be available in the Registry.³ On Linux/macOS, device drivers (in the form of kernel modules) may be visible within `/dev` or using utilities such as `lsmod` and `modinfo`.⁴⁵⁶

1. Microsoft Driverquery
2. Microsoft EnumDeviceDrivers
3. Microsoft Registry Drivers
4. Linux Kernel Programming
5. lsmod man
6. modinfo man

Groups using this technique

Claims

No public claim points at this technique yet.

Auto-ingested and not human-reviewed; confidence and validity read by citation.