Sprysocks Fonts Driver Manual Mapper
Detects a manual kernel mapper referencing a Fonts-hosted encrypted driver and PE relocation APIs. The rule looks for specific strings often associated with malicious kernel-mode operations, including references to the Windows Fonts directory, and API calls like ZwAllocateVirtualMemory, RtlImageNtHeader, MmGetSystemRoutineAddress, and DriverEntry, which are indicative of dynamic driver loading and PE header manipulation.
YARA
