SprySOCKS Driver Service Removed Shortly After Creation

Daniel Jeremiah@daniyyell

•updated Jun 20, 2026•0•0•2

This rule correlates the creation and subsequent removal of a driver service within a 15-minute window. It specifically looks for registry events indicating the creation and deletion of a service key, where the service's image path ends with '.sys' or the key name contains 'msidiskserver'. This behavior is indicative of the transient driver-loading workflow used by SprySOCKS malware.