Security Driver and Service Enumeration
This rule detects attempts to enumerate security-related drivers and services, specifically targeting ESET, Npcap, NPF, and Sysmon components. It looks for command-line utilities like 'sc', 'reg', 'cmd', 'powershell', or 'pwsh' being used with specific driver/service names. The XQL view includes actor and causality fields for investigation.
Cortex XDR
