Add detection for PnPUtil driver and device removal activity

rules/windows/powershell/powershell_script/posh_ps_create_volume_shadow_copy.yml

@@ -9,7 +9,6 @@ date: 2022-01-12
 tags:
     - attack.credential-access
     - attack.t1003.003
-    - attack.ds0005
 logsource:
     product: windows
     category: ps_script

rules/windows/process_creation/proc_creation_win_pnputil_driver_device_removal.yml

@@ -0,0 +1,32 @@
+title: Suspicious Driver or Device Removal via PnPUtil
+id: decca722-d099-46df-b6c0-288634960122
+status: experimental
+description: Detects when a driver is deleted/uninstalled or a device is disabled/removed using the built-in Plug and Play Utility (pnputil.exe). This behavior is often observed when threat actors attempt to disable security product drivers (defense evasion) or uninstall drivers after exploiting them (BYOVD clean-up).
+references:
+    - https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/pnputil-command-syntax
+    - https://redcanary.com/blog/threat-hunting-driver-tampering/
+    - https://www.microsoft.com/en-us/security/blog/2022/12/12/investigating-impairment-of-defenses/
+author: Keerthivasan
+date: 2026-06-29
+tags:
+    - attack.defense-impairment
+    - attack.t1685
+logsource:
+    category: process_creation
+    product: windows
+detection:
+    selection_img:
+        - Image|endswith: '\pnputil.exe'
+        - OriginalFileName: 'pnputil.exe'
+    selection_cmd:
+        CommandLine|contains:
+            - 'delete-driver'
+            - 'disable-device'
+            - 'remove-device'
+    condition: all of selection_*
+falsepositives:
+    - System administrators or deployment scripts updating drivers by removing old versions.
+    - Antivirus or hardware OEM software updates (e.g. Dell, Lenovo, HP update managers).
+    - VMware Tools, VirtualBox Guest Additions, or other VM guest integration agent updates.
+    - Device drivers uninstallation during legitimate system maintenance.
+level: medium

tests/sigma_cli_conf.yml

@@ -70,5 +70,3 @@ exclusions:
     # SigmahqRedundantFieldIssue
     0f06a3a5-6a09-413f-8743-e6cf35561297: sigmahq_redundant_field
     f7f9ab88-7557-4a69-b30e-0a8f91b3a0e7: sigmahq_redundant_field
-    # InvalidATTACKTagIssue remove after pySigma 1.0.0 release
-    afd12fed-b0ec-45c9-a13d-aa86625dac81: attacktag