Drivers

Input Capture

Collection, Credential Access

Monitor the Registry and file system for suspicious driver installs

SELECT Class, DriverSigned, OriginalFileName, Provider
GROUP BY Class, DriverSigned, OriginalFileName, Provider

• Mitre - Input Capture