Device Driver List Enumerated via Web Shell
This rule detects attempts to enumerate device drivers on a system via a web shell. It specifically looks for HTTP requests containing the string "driverquery" in the URI, which is a command-line utility on Windows systems used to display a list of installed device drivers and their properties. The detection is case-insensitive and targets established HTTP connections to the server.
Suricata
