Clfs.SYS Loaded By Process From Suspicious Location
Detects Clfs.sys being loaded by a process running from a potentially suspicious location. Clfs.sys is loaded as part of many CVEs exploits that targets Common Log File System (CLFS) driver vulnerabilities. The rule identifies processes loading 'clfs.sys' from common temporary or user-writable directories often abused by malware or exploits.
Sigma
