Device Driver Discovery (T1652)

Tactic: Discovery · Platforms: Linux, macOS, Windows

The interactive view maps 1 detection strategy, 1 threat group, 3 software entries to this technique, alongside D3FEND countermeasures and data-component coverage.

Overview

Adversaries may attempt to enumerate local device drivers on a victim host. Information about device drivers may highlight various insights that shape follow-on behaviors, such as the function/purpose of the host, present security tools (i.e. Security Software Discovery) or other defenses (e.g., Virtualization/Sandbox Evasion), as well as potential exploitable vulnerabilities (e.g., Exploitation for Privilege Escalation).

Many OS utilities may provide information about local device drivers, such as `driverquery.exe` and the `EnumDeviceDrivers()` API function on Windows. Information about device drivers (as well as associated services, i.e., System Service Discovery) may also be available in the Registry.

On Linux/macOS, device drivers (in the form of kernel modules) may be visible within `/dev` or using utilities such as `lsmod` and `modinfo`.

Explore

• Open T1652 in the interactive ATT&CK matrix
• ATT&CK Intelligence View guide
• Official MITRE ATT&CK entry for T1652
• Sigma detection rules for MITRE ATT&CK
• Built by Shahrukh Khan