Identifier / Programs / Windows
pnputil.exe
Pnputil.exe is a command line utility that you can use to manage the driver store. Windows commands reference
LOLBAS Execute 1 Sigma rule name it 1 ATT&CK technique 1 documented command 8 known copies with hashes
How pnputil.exe is abused
Execute T1547 Boot or Logon Autostart Execution
-iSpecifies to install the identified INF file. Windows commands reference-aSpecifies to add the identified INF file. Windows commands referenceEach abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for pnputil.exe.
1 documented command
Execute T1547 Boot or Logon Autostart Execution Administrator privileges
Used for installing drivers
pnputil.exe -i -a {PATH_ABSOLUTE:.inf}Trips 1 Sigma rule: mediumSuspicious Driver Install by pnputil.exe by Hai Vaknin @LuxNoBulIshit, Avihay eldad @aloneliassaf, Austin Songer @austinsonger
The command the identifier reads trips a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for pnputil.exe, by Hai vaknin (lux), at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for pnputil.exe. The identifier reads it with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.
What detects it
Is it the real pnputil.exe?
C:\Windows\system32\8 known copies
10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\pnputil.exe · signed by Microsoft Windows
253ef517a9bec4cba5b29b2b717776cd307b5d78ef7d11bfaba33966781206fc10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\pnputil.exe · signed by Microsoft Windows
008e3ef11d666d456902b267c192aaa57adc69ca9b6680c6136043695be5644b10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\pnputil.exe · signed by Microsoft Windows
25efa393011172fbdedb60b362c82dd5b026b9edfaccac77ad4c60db1e1e79c610.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\pnputil.exe · signed by Microsoft Windows
490896a34dc2cd9b02ef4f568eac69cbf4c14ef085471ee43bb48336fa0b373610.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\pnputil.exe · signed by Microsoft Windows
d9d80aae27b350994d2917609b1944187b769de4798f2bc0ff5fd1f58af1df1910.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\pnputil.exe · signed by Microsoft Windows
38f65ccc55e9c28bfb8e44a11a8295f3dd9f73de29f67ff5e043f0bd5a2003ef10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\pnputil.exe · signed by Microsoft Windows
d11ea7611a503979c30531eb7f8e5c6f75c874b09b590f8f6b12da84f6272fa26.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\PnPutil.exe · not signed
47ddc47f579cdf2afcd1fe1fa1fa4241746775273cf82bff02388e20aec1554aFrom the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.
Everyday use
List all installed driver packages
pnputil /enum-driversIdentifyInstall a driver package from an INF file
pnputil /add-driver path\to\driver.infIdentifyTrips 1 Sigma rule: mediumSuspicious Driver Install by pnputil.exe by Hai Vaknin @LuxNoBulIshit, Avihay eldad @aloneliassaf, Austin Songer @austinsonger
Add and install all INF files in a folder (including subdirectories)
pnputil /add-driver path\to\folder\*.inf /subdirsIdentifyTrips 1 Sigma rule: mediumSuspicious Driver Install by pnputil.exe by Hai Vaknin @LuxNoBulIshit, Avihay eldad @aloneliassaf, Austin Songer @austinsonger
Of the 3 examples the identifier reads, 2 match LOLBAS abuse or trip a Sigma process-creation rule.
Options
Show every option of pnputil.exe
-aSpecifies to add the identified INF file.-dSpecifies to delete the identified INF file.-eSpecifies to enumerate all third-party INF files.-fSpecifies to force the deletion of the identified INF file.-iSpecifies to install the identified INF file./?Displays help at the command prompt.