Windows driverquery.exe Used for Installed Driver Recon

Alerts when driverquery.exe (drvqry.exe) is launched by script-based parent processes to enumerate installed drivers.

FreeUnreviewedSigmahighv1

windows-driverquery-exe-used-for-installed-driver-recon-9fc3072c

title: Windows driverquery.exe Used for Installed Driver Recon
id: e4e26b30-13fb-4bdc-a245-0b6d3c2c657a
related:
  - id: a20def93-0709-4eae-9bd2-31206e21e6b2
    type: similar
  - id: 9fc3072c-dc8f-4bf7-b231-18950000fadd
    type: derived
status: test
description: This rule flags process executions of driverquery.exe (or its OriginalFileName alias drvqry.exe) that are initiated by common script and scripting-loader parents. Reconnaissance of installed drivers can help attackers map the host environment before further activity or exploitation. The detection relies on Windows process creation telemetry, matching the executable name and the parent process image/path characteristics.
references:
  - https://thedfirreport.com/2023/01/09/unwrapping-ursnifs-gifts/
  - https://www.vmray.com/cyber-security-blog/analyzing-ursnif-behavior-malware-sandbox/
  - https://www.fireeye.com/blog/threat-research/2020/01/saigon-mysterious-ursnif-fork.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_driverquery_recon.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-19
modified: 2023-09-29
tags:
  - attack.discovery
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: driverquery.exe
    - OriginalFileName: drvqry.exe
  selection_parent:
    - ParentImage|endswith:
        - \cscript.exe
        - \mshta.exe
        - \regsvr32.exe
        - \rundll32.exe
        - \wscript.exe
    - ParentImage|contains:
        - \AppData\Local\
        - \Users\Public\
        - \Windows\Temp\
  condition: all of selection_*
falsepositives:
  - Legitimate usage by some scripts might trigger this as well
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_driverquery_recon/info.yml
license: DRL-1.1

What it detects

This rule flags process executions of driverquery.exe (or its OriginalFileName alias drvqry.exe) that are initiated by common script and scripting-loader parents. Reconnaissance of installed drivers can help attackers map the host environment before further activity or exploitation. The detection relies on Windows process creation telemetry, matching the executable name and the parent process image/path characteristics.

Known false positives

Legitimate usage by some scripts might trigger this as well

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.