Detects driver load of the Process Hacker tool

Detects driver load of the System Informer tool

Detects the load of known vulnerable drivers by hash value

Detects the load of known vulnerable drivers via their names only.

Detects well-known credential dumping tools execution via service execution events

Detects a driver load from a temporary directory

Detects the load of the signed poortry driver used by UNC3944 as reported by Mandiant and Sentinel One.

Detects the load of a signed and vulnerable AVAST Anti Rootkit driver often used by threat actors or malware for stopping and disabling AV and EDR products

Detects the load of the vulnerable Dell BIOS update driver as reported in CVE-2021-21551

Detects the load of a signed and vulnerable GIGABYTE driver often used by threat actors or malware for privilege escalation

Detects the load of HackSys Extreme Vulnerable Driver which is an intentionally vulnerable Windows driver developed for security enthusiasts to learn and polish their exploitation skills at Kernel level and often abused by threat actors

Detects the load of a legitimate signed driver named HW.sys by often used by threat actors or malware for privilege escalation

Detects the load of the vulnerable Lenovo driver as reported in CVE-2022-3699 which can be used to escalate privileges

Detects the load of a signed WinRing0 driver often used by threat actors, crypto miners (XMRIG) or malware for privilege escalation

Detects the load of the Windiver driver, a powerful user-mode capture/sniffing/modification/blocking/re-injection package for Windows

Detects powershell script installed as a Service