Adversaries may attempt to enumerate local device drivers on a victim host. Information about device drivers may highlight various insights that shape follow-on behaviors, such as the function/purpose of the host, present security tools (i.e. [Security Software Discovery](https://attack.mitre.org/techniques/T1518/001)) or other defenses (e.g., [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497)), as well as potential exploitable vulnerabilities (e.g., [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068)).

Many OS utilities may provide information about local device drivers, such as `driverquery.exe` and the `EnumDeviceDrivers()` API function on Windows.(Citation: Microsoft Driverquery)(Citation: Microsoft EnumDeviceDrivers) Information about device drivers (as well as associated services, i.e., [System Service Discovery](https://attack.mitre.org/techniques/T1007)) may also be available in the Registry.(Citation: Microsoft Registry Drivers)

On Linux/macOS, device drivers (in the form of kernel modules) may be visible within `/dev` or using utilities such as `lsmod` and `modinfo`.(Citation: Linux Kernel Programming)(Citation: lsmod man)(Citation: modinfo man)
Device Driver Discovery
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1652  external_id: T1652     source_name: lsmod man  description: Kerrisk, M. (2022, December 18). lsmod(8) — Linux manual page. Retrieved March 28, 2023.  url: https://man7.org/linux/man-pages/man8/lsmod.8.html     source_name: Microsoft Registry Drivers  description: Microsoft. (2021, December 14). Registry Trees for Devices and Drivers. Retrieved March 28, 2023.  url: https://learn.microsoft.com/windows-hardware/drivers/install/overview-of-registry-trees-and-keys     source_name: Microsoft EnumDeviceDrivers  description: Microsoft. (2021, October 12). EnumDeviceDrivers function (psapi.h). Retrieved March 28, 2023.  url: https://learn.microsoft.com/windows/win32/api/psapi/nf-psapi-enumdevicedrivers     source_name: Microsoft Driverquery  description: Microsoft. (n.d.). driverquery. Retrieved March 28, 2023.  url: https://learn.microsoft.com/windows-server/administration/windows-commands/driverquery     source_name: Linux Kernel Programming  description: Pomerantz, O., Salzman, P.. (2003, April 4). The Linux Kernel Module Programming Guide. Retrieved April 6, 2018.  url: https://www.tldp.org/LDP/lkmpg/2.4/lkmpg.pdf     source_name: modinfo man  description: Russell, R. (n.d.). modinfo(8) - Linux man page. Retrieved March 28, 2023.  url: https://linux.die.net/man/8/modinfo     