Atomic Red Team doc generator
50 lines
2.1 KiB
Markdown
50 lines
2.1 KiB
Markdown
# T1652 - Device Driver Discovery
|
|
## [Description from ATT&CK](https://attack.mitre.org/techniques/T1652)
|
|
<blockquote>
|
|
|
|
Adversaries may attempt to enumerate local device drivers on a victim host. Information about device drivers may highlight various insights that shape follow-on behaviors, such as the function/purpose of the host, present security tools (i.e. [Security Software Discovery](https://attack.mitre.org/techniques/T1518/001)) or other defenses (e.g., [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497)), as well as potential exploitable vulnerabilities (e.g., [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068)).
|
|
|
|
Many OS utilities may provide information about local device drivers, such as `driverquery.exe` and the `EnumDeviceDrivers()` API function on Windows.(Citation: Microsoft Driverquery)(Citation: Microsoft EnumDeviceDrivers) Information about device drivers (as well as associated services, i.e., [System Service Discovery](https://attack.mitre.org/techniques/T1007)) may also be available in the Registry.(Citation: Microsoft Registry Drivers)
|
|
|
|
On Linux/macOS, device drivers (in the form of kernel modules) may be visible within `/dev` or using utilities such as `lsmod` and `modinfo`.(Citation: Linux Kernel Programming)(Citation: lsmod man)(Citation: modinfo man)
|
|
|
|
</blockquote>
|
|
|
|
## Atomic Tests
|
|
|
|
- [Atomic Test #1 - Device Driver Discovery](#atomic-test-1---device-driver-discovery)
|
|
|
|
|
|
<br/>
|
|
|
|
## Atomic Test #1 - Device Driver Discovery
|
|
Displays a list of installed device drivers on the local computer and their properties. Threat actors use this command to enumerate the existing drivers on the computer.
|
|
Parameters:
|
|
/v /fo list - Displays verbose output in a list format - the /v parameter is not valid for signed drivers
|
|
/si /fo list - Provides information about signed drivers and outputs it in a list format
|
|
|
|
**Supported Platforms:** Windows
|
|
|
|
|
|
**auto_generated_guid:** 235b30a2-e5b1-441f-9705-be6231c88ddd
|
|
|
|
|
|
|
|
|
|
|
|
|
|
#### Attack Commands: Run with `powershell`!
|
|
|
|
|
|
```powershell
|
|
driverquery /v /fo list
|
|
driverquery /si /fo list
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<br/>
|