CmdID

CmdID / Rules / Windows

Suspicious Driver Install by pnputil.exe

A Sigma rule for process creation on Windows, by Hai Vaknin @LuxNoBulIshit, Avihay eldad @aloneliassaf, Austin Songer @austinsonger.

medium 1 ATT&CK technique 1 program it names 2 everyday examples trip it

What it looks for

its detection, as SigmaHQ writes it
detection:
  selection:
    CommandLine|contains:
      - '-i'
      - '/install'
      - '-a'
      - '/add-driver'
      - '.inf'
    Image|endswith: '\pnputil.exe'
  condition: selection

The rule’s detection, its selections and fields in order of name. The whole rule, with its references and false positives, is on SigmaHQ, by Hai Vaknin @LuxNoBulIshit, Avihay eldad @aloneliassaf, Austin Songer @austinsonger, under the Detection Rule License 1.1. CmdID evaluates it on a command line alone: a test on what a command line cannot show, such as the parent process or the user, is not met.

Command lines that trip it

everyday examples from tldr-pages, CC BY 4.0, each read by CmdID

Install a driver package from an INF file on the page for pnputil.exe

pnputil /add-driver path\to\driver.infIdentify

Add and install all INF files in a folder (including subdirectories) on the page for pnputil.exe

pnputil /add-driver path\to\folder\*.inf /subdirsIdentify

The commands LOLBAS or GTFOBins documents for pnputil.exe trip it too: each is on its program’s page, read by CmdID.

Programs and files it names

their pages here
pnputil.exe

ATT&CK

the techniques it is tagged with
T1547Boot or Logon Autostart Execution

Other rules for T1547 Boot or Logon Autostart Execution

Suspicious GrpConv Execution