Device Driver Discovery (T1652) is a Discovery technique on Windows, Linux and macOS. Adversaries list the device drivers on a host. What they find can show the host's purpose, security tools present, defenses such as sandboxes, and potentially exploitable software.
How attackers use it
On Windows, MITRE names driverquery.exe and the EnumDeviceDrivers function. Driver and service data is also in the Registry. On Linux and macOS, kernel modules can be seen in the dev directory or with lsmod and modinfo.
Examples: HOPLIGHT can enumerate drivers listed in the registry under HKLM\Software\WBEM\WDM. Medusa Group ran driverquery. INC Ransomware can check for specific drivers such as Microsoft Print to PDF. Remsec has a plugin that detects active drivers of some security products.
How to detect it
MITRE's analytics:
- Windows: use of driverquery.exe, calls to EnumDeviceDrivers, and unusual registry queries under the Services and HardwareProfiles keys. Correlate command execution, process creation and registry access.
- Linux: enumeration of kernel modules through lsmod, modinfo, /proc/modules or /dev, especially by unprivileged users or outside normal administrative work.
- macOS: use of kextstat or kextfind, and file access to the system Extensions folder by non administrative users or scripts.
How to reduce the risk
MITRE says this cannot easily be mitigated, since it abuses system features. Log process creation with command lines and flag driver listing from unexpected parents. Reduce what a driver list reveals by keeping drivers patched.
Driver listing is common in administration, so judge it by context. A help desk tool running driverquery is routine. An unknown binary running it seconds after launch, alongside queries about security software, is a chain worth following. Read-only baseline for your own hosts: run driverquery on Windows or lsmod on Linux and keep the output for comparison.
Quick check
Why would malware want to know about drivers?
They can reveal security products, sandbox or virtualization hints and exploitable software, shaping what the malware does next.
