Malicious Driver Load by Hash
Detects the loading of known malicious drivers by their MD5, SHA1, SHA256, or IMPHASH. These drivers are often used by adversaries for persistence and privilege escalation, particularly in 'Bring Your Own Vulnerable Driver' (BYOVD) attacks to gain kernel-level access.
Sigma
