Windows driverquery.exe Process Execution Detection
Alerts on Windows executions of driverquery.exe (drvqry.exe) used to enumerate installed drivers, with parent-process exclusions to reduce duplicates.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-01-19
- Updated
- 2026-07-31
What it detects
This rule flags process creation events where the executed binary is driverquery.exe or where the file’s OriginalFileName is drvqry.exe. The driverquery utility can be used to enumerate installed drivers, which supports host reconnaissance prior to further activity. It relies on Windows process creation telemetry, including the process image name/path and the OriginalFileName metadata. Alerts are suppressed when the parent process matches certain scripting and system utility parents to reduce duplicate reporting.
Reporting behind it
- thedfirreport.comhttps://thedfirreport.com/2023/01/09/unwrapping-ursnifs-gifts/
- vmray.comhttps://www.vmray.com/cyber-security-blog/analyzing-ursnif-behavior-malware-sandbox/
- fireeye.comhttps://www.fireeye.com/blog/threat-research/2020/01/saigon-mysterious-ursnif-fork.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_driverquery_usage.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows driverquery.exe Process Execution Detection
id: 521cc064-d216-4f15-a058-2b317aaca82c
related:
- id: 9fc3072c-dc8f-4bf7-b231-18950000fadd
type: similar
- id: a20def93-0709-4eae-9bd2-31206e21e6b2
type: derived
status: test
description: This rule flags process creation events where the executed binary is driverquery.exe or where the file’s OriginalFileName is drvqry.exe. The driverquery utility can be used to enumerate installed drivers, which supports host reconnaissance prior to further activity. It relies on Windows process creation telemetry, including the process image name/path and the OriginalFileName metadata. Alerts are suppressed when the parent process matches certain scripting and system utility parents to reduce duplicate reporting.
references:
- https://thedfirreport.com/2023/01/09/unwrapping-ursnifs-gifts/
- https://www.vmray.com/cyber-security-blog/analyzing-ursnif-behavior-malware-sandbox/
- https://www.fireeye.com/blog/threat-research/2020/01/saigon-mysterious-ursnif-fork.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_driverquery_usage.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-19
modified: 2023-09-29
tags:
- attack.discovery
logsource:
category: process_creation
product: windows
detection:
selection:
- Image|endswith: driverquery.exe
- OriginalFileName: drvqry.exe
filter_main_other:
- ParentImage|endswith:
- \cscript.exe
- \mshta.exe
- \regsvr32.exe
- \rundll32.exe
- \wscript.exe
- ParentImage|contains:
- \AppData\Local\
- \Users\Public\
- \Windows\Temp\
condition: selection and not 1 of filter_main_*
falsepositives:
- Legitimate use by third party tools in order to investigate installed drivers
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_driverquery_usage/info.yml
license: DRL-1.1