Potential Reconnaissance Activity Using DriverQuery.EXE
This rule detects the execution of 'driverquery.exe' or 'drvqry.exe' when initiated by specific parent processes or from suspicious directories. The parent processes include scripting engines like cscript.exe, mshta.exe, regsvr32.exe, rundll32.exe, and wscript.exe. Additionally, the rule flags execution where the parent process image path contains common temporary or user-writable directories such as 'AppData\Local\', 'Users\Public\', or 'Windows\Temp\'. This combination aims to identify reconnaissance activity where an attacker is attempting to enumerate installed drivers on a system, potentially as part of a larger compromise, often associated with malware like Ursnif.
Sigma
