Kernel Driver Loading Attempt via Command Line

Ankit Mehta@Secvyn

•updated Jun 23, 2026•1•0•3

This rule detects attempts to load kernel drivers using command-line utilities such as infinstall.exe, devcon.exe, pnputil.exe, or sc.exe. The detection specifically looks for these commands being initiated by powershell.exe, cmd.exe, or ServertoolLauncher.exe, which could indicate malicious activity like ransomware attempting to establish persistence or evade defenses.