Sigma rule: DriverQuery.EXE Execution

Rule

Title

DriverQuery.EXE Execution

Status

test

Level

medium

Author

Nasreddine Bencherchali (Nextron Systems)

Date

2023-01-19

Modified

2023-09-29

File

rules/windows/process_creation/proc_creation_win_driverquery_usage.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detect usage of the "driverquery" utility. Which can be used to perform reconnaissance on installed drivers

Log source

product

windows

category

process_creation

Detection

selection:
    - Image|endswith: 'driverquery.exe'
    - OriginalFileName: 'drvqry.exe'
filter_main_other: # These are covered in 9fc3072c-dc8f-4bf7-b231-18950000fadd to avoid duplicate alerting
    - ParentImage|endswith:
          - '\cscript.exe'
          - '\mshta.exe'
          - '\regsvr32.exe'
          - '\rundll32.exe'
          - '\wscript.exe'
    - ParentImage|contains:
          - '\AppData\Local\'
          - '\Users\Public\'
          - '\Windows\Temp\'
condition: selection and not 1 of filter_main_*

False positives (as the rule lists them)

• Legitimate use by third party tools in order to investigate installed drivers

Tags

• attack.discovery

Related rules

• 9fc3072c-dc8f-4bf7-b231-18950000fadd (similar)

References

• https://thedfirreport.com/2023/01/09/unwrapping-ursnifs-gifts/
• https://www.vmray.com/cyber-security-blog/analyzing-ursnif-behavior-malware-sandbox/
• https://www.fireeye.com/blog/threat-research/2020/01/saigon-mysterious-ursnif-fork.html

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_driverquery_usage.yml