Capabilities

security.execution.command

Contract

Outputs

process.output

Command execution output

Side effects: process_spawn

Produces

process.output

Used for installing drivers (Add malicious driver)

pnputil.exe -i -a {PATH_ABSOLUTE:.inf}

Type	Rule / Indicator
sigma	https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_susp_driver_installed_by_pnputil.yml

pnputil is a Windows LOLBin. Used for installing drivers Located at: C:\Windows\system32\pnputil.exe.