Suspicious Driver Install by pnputil.exe (via process_creation)

title: Suspicious Driver Install by pnputil.exe (via process_creation)
id: b1efd059-963a-5d18-994d-f5de7abab352
status: stable
description: This rule detects when a possible anomalous driver is being installed via pnputil.exe lolbin
references:
    - https://attack.mitre.org/techniques/T1547/
    - https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/pnputil-command-syntax
    - https://strontic.github.io/xcyclopedia/library/pnputil.exe-60EDC5E6BDBAEE441F2E3AEACD0340D2.html
author: Huntrule Team
date: 2026-05-21
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1547
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains:
            - '-i'
            - '/install'
            - '-a'
            - '/add-driver'
            - '.inf'
        Image|endswith: '\pnputil.exe'
    condition: selection
falsepositives:
    - Unknown
level: medium