DriverQuery.EXE Execution

Status: test
Severity: medium
Log source: category process_creation, product windows
Author: Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detect usage of the "driverquery" utility. Which can be used to perform reconnaissance on installed drivers

Known false positives

Legitimate use by third party tools in order to investigate installed drivers

MITRE ATT&CK coverage

Tactic	Techniques
Discovery	No specific technique

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: DriverQuery.EXE Execution
id: a20def93-0709-4eae-9bd2-31206e21e6b2
related:
    - id: 9fc3072c-dc8f-4bf7-b231-18950000fadd
      type: similar
status: test
description: Detect usage of the "driverquery" utility. Which can be used to perform reconnaissance on installed drivers
references:
    - https://thedfirreport.com/2023/01/09/unwrapping-ursnifs-gifts/
    - https://www.vmray.com/cyber-security-blog/analyzing-ursnif-behavior-malware-sandbox/
    - https://www.fireeye.com/blog/threat-research/2020/01/saigon-mysterious-ursnif-fork.html
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-01-19
modified: 2023-09-29
tags:
    - attack.discovery
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        - Image|endswith: 'driverquery.exe'
        - OriginalFileName: 'drvqry.exe'
    filter_main_other: # These are covered in 9fc3072c-dc8f-4bf7-b231-18950000fadd to avoid duplicate alerting
        - ParentImage|endswith:
              - '\cscript.exe'
              - '\mshta.exe'
              - '\regsvr32.exe'
              - '\rundll32.exe'
              - '\wscript.exe'
        - ParentImage|contains:
              - '\AppData\Local\'
              - '\Users\Public\'
              - '\Windows\Temp\'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Legitimate use by third party tools in order to investigate installed drivers
level: medium # Level could be reduced to low if this utility is often used in your environment
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_driverquery_usage/info.yml

Stages and Predicates

Stage 0: `condition`

selection and not 1 of filter_main_*

Stage 1: `selection`

selection:
    - Image|endswith: 'driverquery.exe'
    - OriginalFileName: 'drvqry.exe'

Stage 2: `not filter_main_other`

filter_main_other:
    - ParentImage|endswith:
          - '\cscript.exe'
          - '\mshta.exe'
          - '\regsvr32.exe'
          - '\rundll32.exe'
          - '\wscript.exe'
    - ParentImage|contains:
          - '\AppData\Local\'
          - '\Users\Public\'
          - '\Windows\Temp\'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`ParentImage`	ends_with	`\cscript.exe`	`excludes:ParentImage` `field:"ParentImage" value:"\cscript.exe"`
`ParentImage`	ends_with	`\mshta.exe`	`excludes:ParentImage` `field:"ParentImage" value:"\mshta.exe"`
`ParentImage`	ends_with	`\regsvr32.exe`	`excludes:ParentImage` `field:"ParentImage" value:"\regsvr32.exe"`
`ParentImage`	ends_with	`\rundll32.exe`	`excludes:ParentImage` `field:"ParentImage" value:"\rundll32.exe"`
`ParentImage`	ends_with	`\wscript.exe`	`excludes:ParentImage` `field:"ParentImage" value:"\wscript.exe"`
`ParentImage`	match	`\AppData\Local\`	`excludes:ParentImage` `field:"ParentImage" value:"\AppData\Local\"`
`ParentImage`	match	`\Users\Public\`	`excludes:ParentImage` `field:"ParentImage" value:"\Users\Public\"`
`ParentImage`	match	`\Windows\Temp\`	`excludes:ParentImage` `field:"ParentImage" value:"\Windows\Temp\"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Image`	ends_with	`driverquery.exe` corpus 2 (sigma 2)	`field:"Image" kind:ends_with value:"driverquery.exe"`
`OriginalFileName`	eq	`drvqry.exe` corpus 2 (sigma 2)	`field:"OriginalFileName" kind:eq value:"drvqry.exe"`