Medusa GroupG1051 ↗
Has queried drivers on the victim device through the command driverquery.1
tfMITRE ATT&CK technique
Device Driver Discovery T1652
- Tactic
- Discovery
- Platforms
- Linux, macOS, Windows
- Version
- 1.0
- Created
- 28 March 2023
- Last modified
- 15 April 2025
- Contributor
- ESET
Adversaries may attempt to enumerate local device drivers on a victim host. Information about device drivers may highlight various insights that shape follow-on behaviors, such as the function/purpose of the host, present security tools (i.e. Security Software Discovery) or other defenses (e.g., Virtualization/Sandbox Evasion), as well as potential exploitable vulnerabilities (e.g., Exploitation for Privilege Escalation).
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
1
Threat groups45th pct
Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.3
Tools & malware57th pct
Tools & malware57th percentile · 57% of ATT&CK techniques have this many tools implementing them or fewer.0
Detection rulesNone recorded
Detection rulesNone recorded · 33% of ATT&CK techniques have none either.Device Driver Discovery MITRE reference T1652
45th pctamong all ATT&CK techniques for number of groups
1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
All 1 groups for this technique
3 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
INC RansomwareS1139 ↗
Can verify the presence of specific drivers on compromised hosts including Microsoft Print to PDF and Microsoft XPS Document Writer.1
HOPLIGHTS0376 ↗
Can enumerate device drivers located in the registry at HKLM\Software\WBEM\WDM.1
RemsecS0125 ↗
Has a plugin to detect active drivers of some security products.1
All 3 software entries for this technique
Offense vs defense T1652
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
Device Driver Discovery detection strategy DET0579
MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection Strategy for Device Driver Discovery
3 platforms
AN1595 · Windows
Monitor for suspicious usage of driver enumeration utilities (driverquery.exe) or API calls such as EnumDeviceDrivers(). Registry queries against HKLM\SYSTEM\CurrentControlSet\Services and HardwareProfiles that are abnormal may also indicate attempts to discover installed drivers and services. Correlate command execution, process creation, and registry access to build a behavioral chain of driver discovery.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Security | EventCode=4688 |
| Windows Registry Key ModificationDC0063 | WinEventLog:Sysmon | EventCode=13, 14 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| AllowedUtilities | Whitelist expected administrative usage of driverquery.exe or other enumeration utilities. |
| TimeWindow | Correlation window between process creation and registry queries to identify suspicious chaining of events. |
AN1596 · Linux
Detect attempts to enumerate kernel modules through lsmod, modinfo, or inspection of /proc/modules and /dev entries. Focus on unusual execution contexts such as unprivileged users or processes outside expected administrative workflows.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| File AccessDC0055 | auditd:FS | read: File access to /proc/modules or /sys/module/ |
| Command ExecutionDC0064 | auditd:SYSCALL | execve: Execution of lsmod, modinfo, or cat /proc/modules |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| KnownAdminUsers | Limit detection noise by filtering expected kernel module inspection by root or system maintenance scripts. |
AN1597 · macOS
Detect loading or inspection of kernel extensions (kextstat, kextfind) and file access to /System/Library/Extensions/. Monitor unexpected usage of these utilities by non-administrative users or scripts.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | macos:unifiedlog | exec: Execution of kextstat, kextfind, or ioreg targeting driver information |
| File AccessDC0055 | macos:unifiedlog | read: File access to /System/Library/Extensions/ or related kernel extension paths |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| AllowedMaintenanceTasks | Tune detection by excluding expected system diagnostic or patch-related invocations of kext utilities. |
Tests5Executorsbash 4 · PowerShell 1Need elevation0 of 5Have prerequisites0Have cleanup0Platformswindows, linux, macos
Tests from Atomic Red Team (MIT licence) · technique definition