Suspicious Driver Loading Patterns
Detects suspicious patterns of driver loading activity, specifically looking for multiple driver load attempts (sc create, sc start, net start, wmic service) involving .sys, kernel, or driver files from non-System32 directories or within the Temp directory. This pattern can indicate an attempt to install a rootkit or other malicious kernel-mode software.
Microsoft Sentinel (KQL)
