Skip to content

DS0027 Driver

A computer program that operates or controls a particular type of device that is attached to a computer. Provides a software interface to hardware devices, enabling operating systems and other computer programs to access hardware functions without needing to know precise details about the hardware being used12

Item Value
ID DS0027
Platforms Linux, Windows, macOS
Collection Layers Host
Version 1.0
Created 20 October 2021
Last Modified 30 March 2022

Data Components

Driver Load

Attaching a driver to either user or kernel-mode of a system (ex: Sysmon EID 6)

Domain ID Name
enterprise T1547 Boot or Logon Autostart Execution
enterprise T1547.008 LSASS Driver
enterprise T1547.012 Print Processors
enterprise T1543 Create or Modify System Process
enterprise T1543.003 Windows Service
enterprise T1561 Disk Wipe
enterprise T1561.001 Disk Content Wipe
enterprise T1561.002 Disk Structure Wipe
enterprise T1068 Exploitation for Privilege Escalation
enterprise T1056 Input Capture
enterprise T1056.001 Keylogging
enterprise T1111 Multi-Factor Authentication Interception

Driver Metadata

Contextual data about a driver and activity around it such as driver issues reporting or integrity (page hash, code) checking

Domain ID Name
enterprise T1542 Pre-OS Boot
enterprise T1542.002 Component Firmware

References

Back to top