Vulnerable Driver Load By Name
This rule detects the loading of known vulnerable drivers by their file names. Adversaries often leverage these vulnerable drivers to achieve privilege escalation or persistence on a system, typically by exploiting a known vulnerability in the driver to execute arbitrary code in kernel mode. The list of driver file names included in the detection logic corresponds to drivers identified as vulnerable, often used in 'Bring Your Own Vulnerable Driver' (BYOVD) attacks.
Sigma
