CQL Hubby ByteRay
← All queries

Enumerate Windows Driver Loads

The query combines DriverLoad and Event_ModuleSummaryInfoEvent data to associate loaded driver hashes with their certificate details, simplifying file paths and aggregating filenames, subjects, and issuers for analysis of driver authenticity.

CQL · Falcon Next-Gen SIEMCopy query
Loading query…
Enumerate_Windows_Driver_Loads.yml
CrowdStrike
Hunting
Endpoint
Insight

Want this running in your SIEM — with someone on call?

Our Managed SIEM team operates CrowdStrike Falcon Next-Gen SIEM in production, with over 350 battle-tested use cases and 24/7 incident response behind them.

Talk to the SIEM team