New Kernel Driver Via SC.EXE
Detects the creation of a new kernel driver service using 'sc.exe'. This activity can be indicative of persistence or privilege escalation attempts by adversaries, as kernel drivers operate with high privileges. The rule specifically looks for 'sc.exe' commands that include 'create' or 'config' along with 'binPath', 'type', and 'kernel' parameters. It includes filters for known legitimate Avira driver installations to reduce false positives.
Sigma
