Enumerate Windows Driver Loads
The query combines DriverLoad and Event_ModuleSummaryInfoEvent data to associate loaded driver hashes with their certificate details, simplifying file paths and aggregating filenames, subjects, and issuers for analysis of driver authenticity.
CQL · Falcon Next-Gen SIEMCopy query
Loading query…Enumerate_Windows_Driver_Loads.yml
CrowdStrike
Hunting
Endpoint
Insight
