Pnputil.exe

Commands

1. ExecuteAdministrator T1547

   Add malicious driver

   pnputil.exe -i -a {PATH_ABSOLUTE:.inf}

   Used for installing drivers

   os: Windows 7, Windows 10, Windows 11

   Execute: INF

Detection

• Sigma https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_susp_driver_installed_by_pnputil.yml

Code samples

• https://github.com/LuxNoBulIshit/test.inf/blob/main/inf