Techniques › T1652 › AN1595
AN1595 Analytic 1595
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Monitor for suspicious usage of driver enumeration utilities (driverquery.exe) or API calls such as EnumDeviceDrivers(). Registry queries against HKLM\SYSTEM\CurrentControlSet\Services and HardwareProfiles that are abnormal may also indicate attempts to discover installed drivers and services. Correlate command execution, process creation, and registry access to build a behavioral chain of driver discovery.</p>
- Detects
- T1652 Device Driver Discovery
- Part of
- DET0579 Detection Strategy for Device Driver Discovery
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Security | EventCode=4688 | DC0032 Process Creation |
| WinEventLog:Sysmon | EventCode=13, 14 | DC0063 Windows Registry Key Modification |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
AllowedUtilities | Whitelist expected administrative usage of driverquery.exe or other enumeration utilities. |
TimeWindow | Correlation window between process creation and registry queries to identify suspicious chaining of events. |