Kernel Driver Enumeration Tool Delivered via HTTP

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•1

This rule detects the delivery of a kernel driver enumeration tool via HTTP. Specifically, it looks for the string "EnumDeviceDrivers" (case-insensitive) within HTTP response data flowing to a client. This string is indicative of tools or malware attempting to enumerate loaded kernel drivers, which is a common reconnaissance technique used by attackers.