type: attack-pattern
spec_version: 2.1
id: attack-pattern--215d9700-5881-48b8-8265-6449dbb7195d
created: 2023-03-28T20:14:49.087Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1652
external_id: T1652
source_name: lsmod man
description: Kerrisk, M. (2022, December 18). lsmod(8) — Linux manual page. Retrieved March 28, 2023.
url: https://man7.org/linux/man-pages/man8/lsmod.8.html
source_name: Microsoft Registry Drivers
description: Microsoft. (2021, December 14). Registry Trees for Devices and Drivers. Retrieved March 28, 2023.
url: https://learn.microsoft.com/windows-hardware/drivers/install/overview-of-registry-trees-and-keys
source_name: Microsoft EnumDeviceDrivers
description: Microsoft. (2021, October 12). EnumDeviceDrivers function (psapi.h). Retrieved March 28, 2023.
url: https://learn.microsoft.com/windows/win32/api/psapi/nf-psapi-enumdevicedrivers
source_name: Microsoft Driverquery
description: Microsoft. (n.d.). driverquery. Retrieved March 28, 2023.
url: https://learn.microsoft.com/windows-server/administration/windows-commands/driverquery
source_name: Linux Kernel Programming
description: Pomerantz, O., Salzman, P.. (2003, April 4). The Linux Kernel Module Programming Guide. Retrieved April 6, 2018.
url: https://www.tldp.org/LDP/lkmpg/2.4/lkmpg.pdf
source_name: modinfo man
description: Russell, R. (n.d.). modinfo(8) - Linux man page. Retrieved March 28, 2023.
url: https://linux.die.net/man/8/modinfo
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-15T22:17:22.391Z
name: Device Driver Discovery
description: Adversaries may attempt to enumerate local device drivers on a victim host. Information about device drivers may highlight various insights that shape follow-on behaviors, such as the function/purpose of the host, present security tools (i.e. [Security Software Discovery](https://attack.mitre.org/techniques/T1518/001)) or other defenses (e.g., [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497)), as well as potential exploitable vulnerabilities (e.g., [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068)).

Many OS utilities may provide information about local device drivers, such as `driverquery.exe` and the `EnumDeviceDrivers()` API function on Windows.(Citation: Microsoft Driverquery)(Citation: Microsoft EnumDeviceDrivers) Information about device drivers (as well as associated services, i.e., [System Service Discovery](https://attack.mitre.org/techniques/T1007)) may also be available in the Registry.(Citation: Microsoft Registry Drivers)

On Linux/macOS, device drivers (in the form of kernel modules) may be visible within `/dev` or using utilities such as `lsmod` and `modinfo`.(Citation: Linux Kernel Programming)(Citation: lsmod man)(Citation: modinfo man)
kill_chain_phases: kill_chain_name: mitre-attack
phase_name: discovery
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: ESET
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Linux
macOS
Windows
x_mitre_version: 1.0