Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1652_device-driver-discovery
Adversaries may attempt to enumerate local device drivers on a victim host.
Passed 22 of 23 test cases with the skill, and 20 of 23 without it.
2 fixed20 passed either way1 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 2 test cases the skill fixed. Same model, same prompt, with and without the skill.
A security analyst wants to discover all available kernel driver files installed on a Linux host, including unloaded ones, specifically under the modules directory for the currently running kernel release. What shell find command targets these .ko binary files?
| Checked | Without skill | With skill |
|---|---|---|
| Recommends running find /lib/modules/$(uname -r)/kernel/drivers -name "*.ko*". | Missed | Passed |
The instructions your model reads when the skill loads.
Adversaries may attempt to enumerate local device drivers on a victim host. Information about device drivers may highlight various insights that shape follow-on behaviors, such as the function/purpose of the host, present security tools (i.e. Security Software Discovery) or other defenses (e.g., Virtualization/Sandbox Evasion), as well as potential exploitable vulnerabilities (e.g., Exploitation for Privilege Escalation).
Many OS utilities may provide information about local device drivers, such as driverquery.exe and the EnumDeviceDrivers() API function on Windows. Information about device drivers (as well as associated services, i.e., System Service Discovery) may also be available in the Registry.
On Linux/macOS, device drivers (in the form of kernel modules) may be visible within /dev or using utilities such as lsmod and modinfo.
Platforms: Linux, macOS, Windows
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Displays a list of installed device drivers on the local computer and their properties. Threat actors use this command to enumerate the existing drivers on the computer. Parameters: /v /fo list - Displays verbose output in a list format - the /v parameter is not valid for signed drivers /si /fo list - Provides information about signed drivers and outputs it in a list format
Supported Platforms: windows
test cases passed, vs 20 / 23 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.