BYOVD - Known Vulnerable Driver Load or Install via sc.exe
Detects potential Bring Your Own Vulnerable Driver (BYOVD) attacks by monitoring for known vulnerable driver files being created or loaded as kernel modules, as well as the registration of kernel-mode drivers from non-standard or user-writable locations like Temp, Tmp, AppData, or Public directories.
SentinelOne
