Loading interactive filters…

1200KM / simulation

T1652 Device Driver Discovery — Attack Simulation

Adversaries may attempt to enumerate local device drivers on a victim host. Information about device drivers may highlight various insights that shape follow-on behaviors, such as the function/purpose of the host, present security tools (i.e. Security Software Discovery) or other defenses (e.g., Virtualization/Sandbox Evasion), as well as potential exploitable vulnerabilities (e.g., Exploitation for Privilege Escalation). Many OS utilities may…

Complete technique description

Many OS utilities may provide information about local device drivers, such as `driverquery.exe` and the `EnumDeviceDrivers()` API function on Windows.[Microsoft Driverquery][Microsoft EnumDeviceDrivers] Information about device drivers (as well as associated services, i.e., System Service Discovery) may also be available in the Registry.[Microsoft Registry Drivers]

On Linux/macOS, device drivers (in the form of kernel modules) may be visible within `/dev` or using utilities such as `lsmod` and `modinfo`.[Linux Kernel Programming][lsmod man][modinfo man]

Official technique definition · Open in the interactive matrix

Detection telemetry and configuration

These contracts are selected through exact technique-to-data-component relationships or explicitly labelled planning overrides. Configure a collector at the relevant observation point; a telemetry name alone is not coverage.

Command Execution · source-mapped

DC0064 collection page — Collect process command lines and relevant shell/interpreter audit; shell history alone is neither complete nor tamper-resistant.

Providers and collection configuration

PowerShell Script Block Logging: Script content via event 4104 when configured; channel depends on PowerShell edition.
Sysmon process events: Interpreter launch and parent context, not full script content.
Linux Audit: execve-family execution context; shell built-ins need additional instrumentation.

Enable Script Block Logging through the policy/configuration for the installed edition. Forward Microsoft-Windows-PowerShell/Operational for Windows PowerShell, or PowerShellCore/Operational for PowerShell 7.
Retain script-block ID and fragment ordering alongside process creation. Protect access to collected script text; secrets may be included.
On Linux, use narrowly scoped Audit execution rules for the lab account and supported architectures, and retain joined SYSCALL/EXECVE/PATH records.

Required normalized fields: interpreter, command_line, actor_uid, session_id.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0064",
  "collector": "illustrative-lab-collector",
  "observation": {
    "interpreter": "/bin/sh",
    "command_line": "printf LAB_TELEMETRY_CHECK",
    "actor_uid": 1000,
    "session_id": "lab-session-1"
  }
}

Visibility limits: Script content and process command lines are different signals. Logging may be partial, fragmented, filtered or disabled; never assume a command line reveals everything executed.

File Access · source-mapped

DC0055 collection page — Enable Audit File System plus a narrow SACL on a lab directory; on Linux select path/syscall rules and join associated Audit records.

Providers and collection configuration

Windows Security auditing: Policy-dependent account, object, task and logon records on the host that performs the operation.

Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.
For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.
Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*.

Required normalized fields: path, access, actor, result.

Illustrative collection event

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0055",
  "collector": "illustrative-lab-collector",
  "observation": {
    "path": "C:\\Lab\\demo.txt",
    "access": "read",
    "actor": "LAB\\analyst",
    "result": "success"
  }
}

Visibility limits: A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.

Process Creation · source-mapped

DC0032 collection page — Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.

Providers and collection configuration

Microsoft Sysmon: Windows event-based collection; enable the event types needed below.
Linux Audit: Linux alternative for supported system-call and file events; different semantics and fields.
Apple Endpoint Security clients: macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.

On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.
Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.
For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms.

Required normalized fields: process_guid, image, parent_image, command_line, user.

<EventFiltering>
  <ProcessCreate onmatch="include">
    <Image condition="is">C:\Windows\System32\whoami.exe</Image>
  </ProcessCreate>
</EventFiltering>

This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>.

Illustrative collection event

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0032",
  "collector": "illustrative-lab-collector",
  "observation": {
    "process_guid": "lab-process-001",
    "image": "C:\\Windows\\System32\\whoami.exe",
    "parent_image": "C:\\Windows\\System32\\cmd.exe",
    "command_line": "whoami",
    "user": "LAB\\analyst"
  }
}

Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.

Windows Registry Key Modification · source-mapped

DC0063 collection page — Use RegistryEvent 13 for value-set and 14 for rename; compare against intended policy and keep original type/value where available.

Providers and collection configuration

Microsoft Sysmon: Windows event-based collection; enable the event types needed below.

On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.
Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.
Keep this Windows-specific source separate from other operating systems; there is no direct cross-platform event-ID equivalence.

Required normalized fields: registry_path, event_type, value_type, value.

Illustrative collection event

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0063",
  "collector": "illustrative-lab-collector",
  "observation": {
    "registry_path": "HKCU\\Software\\Lab\\Mode",
    "event_type": "SetValue",
    "value_type": "DWORD",
    "value": 1
  }
}

Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.

Detection rules and analytic guidance

Open the dedicated detection workspace · Existing query engineering

DET0579 Detection Strategy for Device Driver Discovery

MITRE detection strategy

AN1595 Analytic 1595

Monitor for suspicious usage of driver enumeration utilities (driverquery.exe) or API calls such as EnumDeviceDrivers(). Registry queries against HKLM\SYSTEM\CurrentControlSet\Services and HardwareProfiles that are abnormal may also indicate attempts to discover installed drivers and services. Correlate command execution, process creation, and registry access to build a behavioral chain of driver discovery.

Platforms: Windows.

Process Creation — WinEventLog:Security; channel EventCode=4688.
Windows Registry Key Modification — WinEventLog:Sysmon; channel EventCode=13, 14.

AN1596 Analytic 1596

Detect attempts to enumerate kernel modules through lsmod, modinfo, or inspection of /proc/modules and /dev entries. Focus on unusual execution contexts such as unprivileged users or processes outside expected administrative workflows.

Platforms: Linux.

Command Execution — auditd:SYSCALL; channel execve: Execution of lsmod, modinfo, or cat /proc/modules.
File Access — auditd:FS; channel read: File access to /proc/modules or /sys/module/.

AN1597 Analytic 1597

Detect loading or inspection of kernel extensions (kextstat, kextfind) and file access to /System/Library/Extensions/. Monitor unexpected usage of these utilities by non-administrative users or scripts.

Platforms: macOS.

Process Creation — macos:unifiedlog; channel exec: Execution of kextstat, kextfind, or ioreg targeting driver information.
File Access — macos:unifiedlog; channel read: File access to /System/Library/Extensions/ or related kernel extension paths.

Source rule directory and observation requirements

No exact-tagged Sigma source rule was imported. This does not establish that the technique is undetectable; the MITRE guidance and collection requirements remain relevant.

Before treating a rule as coverage

Read the actual condition and logsource; identify attacker-side, victim-side or third-party visibility.
Map native sensor fields, parse times and identities, then compile for the selected backend.
Replay a behavior-positive case, a normal control, an authorized look-alike and a missing-telemetry case.
Record matches and misses with rule version and source events. No match is inconclusive when required telemetry is absent.

Anomaly-based detection

No exact technique-specific Atlas model is present for T1652 in the selected source snapshot. The following is a design worksheet, not a newly validated model.

Anomaly engineering worksheet

Start from the exact analytic above. The collection-specific lenses below are analyst recommendations; they do not assert that an arbitrary statistical deviation detects this technique.

Script and command execution: Per host role and principal: rare interpreters, command argument patterns and parent-child sequences. Normalize scripts carefully; obfuscation, administrative automation and missing command lines change visibility.
Windows and directory audit: Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance.
Endpoint activity: Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity.

Define an entity/peer group and feature; exclude the evaluation period from baseline training.
Use representative normal and maintenance activity. Do not invent a production threshold from a synthetic example.
Evaluate held-out behavior-positive and benign cases; measure false positives, misses and telemetry loss separately.
Keep abnormality separate from maliciousness. Correlate with the behavior-specific source evidence.

Anomaly Detection Atlas · Baseline, validation and blind spots

Attack tools and documented software

No reviewed lab-tool association is selected for this exact technique. This is a curation gap, not a statement that no tool can implement the behavior.

Software observed in source procedures

These are exact ATT&CK software-use relationships, including malware. They provide behavior context, not recommendations to download or execute malware. No safety or detector claim is inherited.

3 source-documented software associations

S0125 Remsec — malware.
Remsec has a plugin to detect active drivers of some security products.[Kaspersky ProjectSauron Technical Analysis]
Exact relationship: relationship--d77772ff-ead4-49a6-ba55-15b1ff794bd2
S0376 HOPLIGHT — malware.
HOPLIGHT can enumerate device drivers located in the registry at `HKLM\Software\WBEM\WDM`.[US-CERT HOPLIGHT Apr 2019]
Exact relationship: relationship--04a39f08-17e1-46e8-aba0-db4ef1318ba1
S1139 INC Ransomware — malware.
INC Ransomware can verify the presence of specific drivers on compromised hosts including Microsoft Print to PDF and Microsoft XPS Document Writer.[Cybereason INC Ransomware November 2023]
Exact relationship: relationship--3c540022-c6f3-4ca1-a3fa-f3f8fc3e0060

Simulation design and documented procedures

Atomic evidence: 5 compatible documented candidates. Live lab status: not run for these imported procedures.

Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.

Enumerate Kernel Driver Files (Linux)

Finds and lists all kernel driver files on a Linux system in order to provide a broader view of available drivers, not just loaded ones.

Pinned Atomic procedure · 13c0fef5-9be9-4d7f-9c6b-901624e53770 · linux · bash.