{"id":"T1652","name":"Device Driver Discovery","url":"https://attack.mitre.org/techniques/T1652","tactics":["discovery"],"platforms":["Linux","macOS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0579","stix_id":"x-mitre-detection-strategy--ff6c2db6-cc1b-47e0-89a6-536f83b74906","name":"Detection Strategy for Device Driver Discovery","url":"https://attack.mitre.org/detectionstrategies/DET0579","analytics":[{"id":"AN1595","stix_id":"x-mitre-analytic--18e81e76-bae3-44c8-b573-dfd3564a00ad","name":"Analytic 1595","description":"Monitor for suspicious usage of driver enumeration utilities (driverquery.exe) or API calls such as EnumDeviceDrivers(). Registry queries against HKLM\\SYSTEM\\CurrentControlSet\\Services and HardwareProfiles that are abnormal may also indicate attempts to discover installed drivers and services. Correlate command execution, process creation, and registry access to build a behavioral chain of driver discovery.","url":"https://attack.mitre.org/detectionstrategies/DET0579#AN1595","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=4688","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Sysmon","channel":"EventCode=13, 14","data_component":"DC0063","data_component_name":"Windows Registry Key Modification","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"AllowedUtilities","description":"Whitelist expected administrative usage of driverquery.exe or other enumeration utilities."},{"field":"TimeWindow","description":"Correlation window between process creation and registry queries to identify suspicious chaining of events."}],"live":true,"detection_strategies":["DET0579"],"techniques":["T1652"]},{"id":"AN1596","stix_id":"x-mitre-analytic--b55c3339-2d4c-4392-8d26-c257ea2f1bb9","name":"Analytic 1596","description":"Detect attempts to enumerate kernel modules through lsmod, modinfo, or inspection of /proc/modules and /dev entries. Focus on unusual execution contexts such as unprivileged users or processes outside expected administrative workflows.","url":"https://attack.mitre.org/detectionstrategies/DET0579#AN1596","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"execve: Execution of lsmod, modinfo, or cat /proc/modules","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"auditd-syscall"},{"name":"auditd:FS","channel":"read: File access to /proc/modules or /sys/module/","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"auditd-fs"}],"mutable_elements":[{"field":"KnownAdminUsers","description":"Limit detection noise by filtering expected kernel module inspection by root or system maintenance scripts."}],"live":true,"detection_strategies":["DET0579"],"techniques":["T1652"]},{"id":"AN1597","stix_id":"x-mitre-analytic--d9ee822c-6a91-4c83-9698-779ca0bf8663","name":"Analytic 1597","description":"Detect loading or inspection of kernel extensions (kextstat, kextfind) and file access to /System/Library/Extensions/. Monitor unexpected usage of these utilities by non-administrative users or scripts.","url":"https://attack.mitre.org/detectionstrategies/DET0579#AN1597","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"exec: Execution of kextstat, kextfind, or ioreg targeting driver information","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-unifiedlog"},{"name":"macos:unifiedlog","channel":"read: File access to /System/Library/Extensions/ or related kernel extension paths","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"macos-unifiedlog"}],"mutable_elements":[{"field":"AllowedMaintenanceTasks","description":"Tune detection by excluding expected system diagnostic or patch-related invocations of kext utilities."}],"live":true,"detection_strategies":["DET0579"],"techniques":["T1652"]}],"live":true,"version":"1.0","techniques":["T1652"]}],"sigma_rules":[],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}