Windows driverquery.exe Process Execution for Installed Driver Discovery

Alerts on Windows executions of driverquery.exe (drvqry.exe) used to enumerate installed drivers, with parent-process exclusions to reduce duplicates.

FreeUnreviewedSigmamediumv1

windows-driverquery-exe-process-execution-for-installed-driver-discovery-a20def93

title: Windows driverquery.exe Process Execution for Installed Driver Discovery
id: 521cc064-d216-4f15-a058-2b317aaca82c
related:
  - id: 9fc3072c-dc8f-4bf7-b231-18950000fadd
    type: similar
  - id: a20def93-0709-4eae-9bd2-31206e21e6b2
    type: derived
status: test
description: This rule flags process creation events where the executable is driverquery.exe (including executions using the original file name drvqry.exe). Enumerating installed drivers can support discovery and environment reconnaissance prior to further actions. Telemetry relies on Windows process creation data, specifically the image path/name and original filename fields, and it excludes activity spawned from a set of scripting/loader-style parent processes to reduce duplicate alerting.
references:
  - https://thedfirreport.com/2023/01/09/unwrapping-ursnifs-gifts/
  - https://www.vmray.com/cyber-security-blog/analyzing-ursnif-behavior-malware-sandbox/
  - https://www.fireeye.com/blog/threat-research/2020/01/saigon-mysterious-ursnif-fork.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_driverquery_usage.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-19
modified: 2023-09-29
tags:
  - attack.discovery
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Image|endswith: driverquery.exe
    - OriginalFileName: drvqry.exe
  filter_main_other:
    - ParentImage|endswith:
        - \cscript.exe
        - \mshta.exe
        - \regsvr32.exe
        - \rundll32.exe
        - \wscript.exe
    - ParentImage|contains:
        - \AppData\Local\
        - \Users\Public\
        - \Windows\Temp\
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Legitimate use by third party tools in order to investigate installed drivers
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_driverquery_usage/info.yml
license: DRL-1.1

What it detects

This rule flags process creation events where the executable is driverquery.exe (including executions using the original file name drvqry.exe). Enumerating installed drivers can support discovery and environment reconnaissance prior to further actions. Telemetry relies on Windows process creation data, specifically the image path/name and original filename fields, and it excludes activity spawned from a set of scripting/loader-style parent processes to reduce duplicate alerting.

Known false positives

Legitimate use by third party tools in order to investigate installed drivers

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.