ATT&CK v13: Device Driver Discovery
wballenthin opened this issue · comments
Device Driver Discovery (v1.0)
Many OS utilities may provide information about local device drivers, such as driverquery.exe and the EnumDeviceDrivers() API function on Windows.[1][2] Information about device drivers (as well as associated services, i.e., System Service Discovery) may also be available in the Registry.[3]
On Linux/macOS, device drivers (in the form of kernel modules) may be visible within /dev or using utilities such as lsmod and modinfo.[4][5][6]