Windows Service Create Kernel Mode Driver

This analytic identifies the creation of a new kernel mode driver using the `sc.exe` command. The detection leverages process execution logs from Endpoint Detection and Response (EDR) agents, specifically focusing on command-line details. Adding a kernel driver is an uncommon activity in regular operations and can indicate an attempt to gain low-level access to the system. If confirmed malicious, this could allow an attacker to execute code with high privileges, potentially compromising the entire system and evading traditional security measures.