CmdID

CmdID / Commands

driverquery

Enables an administrator to display a list of installed device drivers and their properties. Windows commands reference

On Windows 2 Sigma rules name it File driverquery.exe

Opens CmdID with your command. It is read in your browser and sent nowhere.

Windows

from the Windows commands reference, CC BY 4.0

Enables an administrator to display a list of installed device drivers and their properties. If used without parameters, driverquery runs on the local computer.

driverquery [/s <system> [/u [<domain>\]<username> [/p <password>]]] [/fo {table | list | csv}] [/nh] [/v | /si]
driverquery
driverquery /fo csv
driverquery /nh
driverquery /s server1
driverquery /s server1 /u maindom\user1 /p p@ssw3d
/s <system>Specifies the name or IP address of a remote computer. Do not use backslashes. The default is the local computer.
/u [<domain>]<username>Runs the command with the credentials of the user account as specified by user or domain\user. By default, */s* uses the credentials of the user who is currently logged on to the computer that is issuing the command. /u can't be used unless /s is specified.
/p <password>Specifies the password of the user account that is specified in the /u parameter. /p cannot be used unless /u is specified.
/fo tableFormats the output as a table. This is the default.
/fo listFormats the output as a list.
/fo csvFormats the output with comma-separated values.
/nhOmits the header row from the displayed driver information. Not valid if the /fo parameter is set to list.
/vDisplays verbose output. /v is not valid for signed drivers.
/siProvides information about signed drivers.
/?Displays help at the command prompt.

Windows

from tldr-pages, CC BY 4.0

Display information about installed device drivers.

Display a list of all installed device drivers

driverqueryIdentify

Display a list of drivers in the specified format

driverquery /fo tableIdentify
/foFormats the output as a table. Windows commands reference

Display a list of drivers with a column to indicate if they are signed

driverquery /siIdentify
/siProvides information about signed drivers. Windows commands reference

Exclude the header in the output list

driverquery /nhIdentify
/nhOmits the header row from the displayed driver information. Windows commands reference

Display a list of drivers for a remote machine

driverquery /s hostname /u username /p passwordIdentify
/sSpecifies the name or IP address of a remote computer. Windows commands reference
/uRuns the command with the credentials of the user account as specified by *user* or *domain\user*. Windows commands reference
/pSpecifies the password of the user account that is specified in the /u parameter. Windows commands reference

Display a list of drivers with verbose information

driverquery /vIdentify
/vDisplays verbose output. Windows commands reference

Display help

driverquery /?Identify
/?Displays help at the command prompt. Windows commands reference

What detects it

Sigma process creation rules that name driverquery
highPotential Recon Activity Using DriverQuery.EXENasreddine Bencherchali (Nextron Systems)
mediumDriverQuery.EXE ExecutionNasreddine Bencherchali (Nextron Systems)