T1652 — Device Driver Discovery

Tactic: Discovery · Platforms: Linux, macOS, Windows

Adversaries may attempt to enumerate local device drivers on a victim host. Information about device drivers may highlight various insights that shape follow-on behaviors, such as the function/purpose of the host, present security tools (i.e. Security Software Discovery) or other defenses (e.g.,…

Sigma detection rules (3)

T1652 Device Driver Discovery

title: T1652 Device Driver Discovery
id: f6d0710b-a4c9-42ed-a847-7b89764b72b4
description: 'Detects enumeration of installed device drivers via driverquery.exe or the Win32_SystemDriver WMI/CIM class, the standard Windows utilities cited by MITRE for T1652 Device Driver Discovery. (Original rule matched an unrelated desktop-wallpaper registry key.) Tune using: AllowedUtilities, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1652
author: Shahrukh Khan
date: 2026-01-20
license: MIT
tags:
  - attack.discovery
  - attack.t1652

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection_driverquery:
    Image|endswith: '\driverquery.exe'
  selection_pwsh:
    CommandLine|contains:
      - 'Win32_SystemDriver'
      - 'Get-WmiObject Win32_SystemDriver'
      - 'Get-CimInstance Win32_SystemDriver'

  condition: selection_driverquery or selection_pwsh

falsepositives:
  - Routine IT/helpdesk driver troubleshooting and software/hardware inventory tools querying installed drivers.

level: low

T1652 Device Driver Discovery

title: T1652 Device Driver Discovery
id: 457039af-08ac-4cba-9ca3-4b9976c2fc6c
description: 'Detection Strategy for Device Driver Discovery. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: KnownAdminUsers.'
references:
  - https://attack.mitre.org/techniques/T1652
author: Shahrukh Khan
date: 2026-04-17
license: MIT
tags:
  - attack.discovery
  - attack.t1652

logsource:
  category: process_creation
  product: linux

detection:
  selection:
    type: EXECVE
    a0|endswith:
      - '/lsmod'
      - '/modinfo'
  selection_proc:
    a0|endswith: '/cat'
    a1|contains: '/proc/modules'

  condition: 1 of selection*

falsepositives:
  - lsmod/modinfo are standard sysadmin and package-install commands run frequently; scope to KnownAdminUsers to reduce noise from routine driver troubleshooting.

level: informational

T1652 Device Driver Discovery

title: T1652 Device Driver Discovery
id: daf77a0c-af16-4c87-86a0-c41f75d1f270
description: 'Detection Strategy for Device Driver Discovery. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: AllowedMaintenanceTasks.'
references:
  - https://attack.mitre.org/techniques/T1652
author: Shahrukh Khan
date: 2026-03-13
license: MIT
tags:
  - attack.discovery
  - attack.t1652

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith:
      - '/kextstat'
      - '/systemextensionsctl'
    CommandLine|contains: 'list'

  condition: selection

falsepositives:
  - Routine system administration or troubleshooting commands that list loaded kernel extensions and system extensions.

level: informational

Explore