Transient msidiskserver driver service registration

Daniel Jeremiah@daniyyell

•updated Jun 19, 2026•0•0•4

This rule detects the registration of a Windows service named 'msidiskserver' or a service whose ImagePath ends with 'fsdiskbit.sys'. This activity is associated with the 'FISHMONGERS' threat actor group and their 'SprySocks' malware, which uses a transient driver for persistence. The rule focuses on registry events related to service creation or modification.