Non-Administrators Allowed To Install Drivers For Device Setup Classes

Rule Info

Name
Non-Administrators Allowed To Install Drivers For Device Setup Classes
Author
Nasreddine Bencherchali (Nextron Systems)
Description
Detects changes to the group policy to allow non-administrators to install drivers for device setup classes. If enabled, this setting might weaken your security posture in cases where one of the allowed drivers gets compromised.
Reference
https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.DeviceInstallation::DriverInstall_Classes_AllowUser
Date
2024-01-24 00:00:00
Modified
None
Id
153b151b-1cd3-475b-b1ab-5d46fe3c9e86
Tags
attack.defense_evasion attack.t1564.001
Type
Nextron Sigma feed only (private)

Rule History

THOR Logo  Scan your endpoints, forensic images or collected files with our portable scanner THOR
  Warning: Access to VALHALLA is rate-limited - once you prove unworthy, access gets denied
  Nextron Systems 2022