drop loaded driver list exports or memory dump driver lists · flag drivers not on disk · unsigned drivers · drivers loaded from unusual paths · compare against known-good baselines · runs locally
driver lists
drop driverquery / volatility driver csv
driverquery -v · driverscan · modscan · drvscan
· flags unsigned · unusual path · masquerade · short random name · unknown baseline
drop driverquery / volatility driverscan · modscan csv (multiple files OK)