Suspicious Kernel Driver Service Creation

nomit vyas@xoxo

•updated Jun 23, 2026•0•0•6

Detects the creation of a Windows kernel-mode driver service where the driver binary is located in a suspicious, non-standard directory like Temp, Public, or AppData. This is a common persistence technique for malware, including EDR killers that use vulnerable drivers.