Driver List Queried via Remote WMI Session

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•1

This rule detects attempts to query the list of system drivers on a remote Windows host via a WMI session over SMB (port 445). The detection is based on the presence of the string "Win32_SystemDriver" in the network traffic, indicating a WMI query for system driver information. This activity can be indicative of reconnaissance by an attacker.