// MITRE ATT&CK
T1652 · Device Driver Discovery
Adversaries may attempt to enumerate local device drivers on a victim host. Information about device drivers may highlight various insights that shape follow-on behaviors, such as the function/purpose of the host, present security tools (i.e. [Security Software Discovery](https://attack.mitre.org/te...
How to detect & mitigate it
Detecting Device Driver Discovery starts with your SIEM/EDR telemetry. Write a detection rule with the Sigma generator, analyze suspicious logs in the log analyzer, and place the technique on your coverage with the ATT&CK matrix.
Related techniques
T1033
System Owner/User Discovery T1613
Container and Resource Discovery T1016.001
Internet Connection Discovery T1069
Permission Groups Discovery T1069.003
Cloud Groups T1615
Group Policy Discovery T1087.002
Domain Account T1087.001
Local Account
System Owner/User Discovery T1613
Container and Resource Discovery T1016.001
Internet Connection Discovery T1069
Permission Groups Discovery T1069.003
Cloud Groups T1615
Group Policy Discovery T1087.002
Domain Account T1087.001
Local Account
Source: MITRE ATT&CK®. ATT&CK is a registered trademark of The MITRE Corporation. Content for educational purposes.