Medusa GroupG1051 ↗
Has queried drivers on the victim device through the command driverquery.1
tfMITRE ATT&CK technique
Device Driver Discovery T1652
- Tactic
- Discovery
- Platforms
- Linux, macOS, Windows
- Version
- 1.0
- Created
- 28 March 2023
- Last modified
- 15 April 2025
- Contributor
- ESET
Adversaries may attempt to enumerate local device drivers on a victim host. Information about device drivers may highlight various insights that shape follow-on behaviors, such as the function/purpose of the host, present security tools (i.e. Security Software Discovery) or other defenses (e.g., Virtualization/Sandbox Evasion), as well as potential exploitable vulnerabilities (e.g., Exploitation for Privilege Escalation).
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
1
Threat groups45th pct
Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.3
Tools & malware57th pct
Tools & malware57th percentile · 51% of ATT&CK techniques have fewer tools implementing them.0
Detection rulesNone recorded
Detection rulesNone recorded · 32% of ATT&CK techniques have none either.