Windows: driverquery.exe Usage for Installed Driver Recon
Alerts when driverquery.exe (drvqry.exe) is launched by script-based parent processes to enumerate installed drivers.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-01-19
- Updated
- 2026-07-31
What it detects
This rule flags process executions of driverquery.exe (including instances where the OriginalFileName is drvqry.exe). It focuses on cases where the parent process is a common script or proxy host (cscript.exe, mshta.exe, regsvr32.exe, rundll32.exe, or wscript.exe) and the parent path indicates user-writable or temporary locations such as AppData\Local, Users\Public, or Windows\Temp. This behavior matters because enumerating installed drivers can support discovery and subsequent exploitation planning. It relies on Windows process creation telemetry, including Image/OriginalFileName and ParentImage path details.
Reporting behind it
- thedfirreport.comhttps://thedfirreport.com/2023/01/09/unwrapping-ursnifs-gifts/
- vmray.comhttps://www.vmray.com/cyber-security-blog/analyzing-ursnif-behavior-malware-sandbox/
- fireeye.comhttps://www.fireeye.com/blog/threat-research/2020/01/saigon-mysterious-ursnif-fork.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_driverquery_recon.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: driverquery.exe Usage for Installed Driver Recon"
id: e4e26b30-13fb-4bdc-a245-0b6d3c2c657a
related:
- id: a20def93-0709-4eae-9bd2-31206e21e6b2
type: similar
- id: 9fc3072c-dc8f-4bf7-b231-18950000fadd
type: derived
status: test
description: This rule flags process executions of driverquery.exe (including instances where the OriginalFileName is drvqry.exe). It focuses on cases where the parent process is a common script or proxy host (cscript.exe, mshta.exe, regsvr32.exe, rundll32.exe, or wscript.exe) and the parent path indicates user-writable or temporary locations such as AppData\Local, Users\Public, or Windows\Temp. This behavior matters because enumerating installed drivers can support discovery and subsequent exploitation planning. It relies on Windows process creation telemetry, including Image/OriginalFileName and ParentImage path details.
references:
- https://thedfirreport.com/2023/01/09/unwrapping-ursnifs-gifts/
- https://www.vmray.com/cyber-security-blog/analyzing-ursnif-behavior-malware-sandbox/
- https://www.fireeye.com/blog/threat-research/2020/01/saigon-mysterious-ursnif-fork.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_driverquery_recon.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-19
modified: 2023-09-29
tags:
- attack.discovery
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: driverquery.exe
- OriginalFileName: drvqry.exe
selection_parent:
- ParentImage|endswith:
- \cscript.exe
- \mshta.exe
- \regsvr32.exe
- \rundll32.exe
- \wscript.exe
- ParentImage|contains:
- \AppData\Local\
- \Users\Public\
- \Windows\Temp\
condition: all of selection_*
falsepositives:
- Legitimate usage by some scripts might trigger this as well
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_driverquery_recon/info.yml
license: DRL-1.1