Suspicious Kernel Driver Service Creation from User-Writable Paths
Detects the creation of a Windows kernel service using sc.exe where the binary path points to common user-writable or temporary directories. This is a common TTP for Bring Your Own Vulnerable Driver (BYOVD) attacks, often used for privilege escalation and persistence.
Microsoft Sentinel (KQL)
