LOL · Binary

Pnputil.exe

1 techniqueWindowsLOLBASGPL-3.0

Execute

ExecutionWindows

Used for installing drivers

Use Add malicious driver

pnputil.exe -i -a {PATH_ABSOLUTE:.inf}

Evidence: Upstream reference
Environment: Local host
Context: admin
Native: Execute
MITRE: T1547
Detection: Sigma: github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_susp_driver_installed_by_pnputil.yml
Refs: lolbas-project.github.io/lolbas/Binaries/Pnputil/