Potential Privileged System Service Operation - SeLoadDriverPrivilege
This rule detects the usage of the 'SeLoadDriverPrivilege' privilege, which is necessary to load or unload device drivers. This privilege allows a user to dynamically load and unload kernel-mode code, excluding Plug and Play device drivers. The rule aims to identify potentially malicious kernel driver loading by filtering out known legitimate processes and tools. It specifically mentions detecting tools like Ghost-In-The-Logs and Sysinternals, indicating that a whitelist approach is required to reduce false positives.
Sigma
