Detects driver load of the Process Hacker tool

Detects driver load of the System Informer tool

Detects service creation from KrbRelayUp tool used for privilege escalation in windows domain environments where LDAP signing is not enforced (the default settings)

Detects a service installed by a client which has PID 0 or whose parent has PID 0

Detects blocked load attempts of revoked drivers

Detects blocked load events that did not meet the authenticode signing level requirements or violated code integrity policy

Detects the load of the signed poortry driver used by UNC3944 as reported by Mandiant and Sentinel One.

Detects the load of the vulnerable Dell BIOS update driver as reported in CVE-2021-21551

Detects the load of the vulnerable Lenovo driver as reported in CVE-2022-3699 which can be used to escalate privileges

Detects a service installed by a client which has PID 0 or whose parent has PID 0