Possible Execution of DriverQuery.EXE (via process_creation)

title: Possible Execution of DriverQuery.EXE (via process_creation)
id: 1f1816f1-7278-5f98-bba0-b5eb770f5451
status: stable
description: This rule detects use of the "driverquery" utility. That can be leveraged to perform reconnaissance on installed drivers
references:
    - https://thedfirreport.com/2023/01/09/unwrapping-ursnifs-gifts/
    - https://www.vmray.com/cyber-security-blog/analyzing-ursnif-behavior-malware-sandbox/
    - https://www.fireeye.com/blog/threat-research/2020/01/saigon-mysterious-ursnif-fork.html
author: Huntrule Team
date: 2026-01-04
tags:
    - attack.discovery
    - attack.t1652
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        - Image|endswith: 'driverquery.exe'
        - OriginalFileName: 'drvqry.exe'
    filter_main_other:
        - ParentImage|endswith:
              - '\cscript.exe'
              - '\mshta.exe'
              - '\regsvr32.exe'
              - '\rundll32.exe'
              - '\wscript.exe'
        - ParentImage|contains:
              - '\AppData\Local\'
              - '\Users\Public\'
              - '\Windows\Temp\'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_driverquery_usage/info.yml