BYOVD Driver Drop and Kernel Service Creation Correlation (T1068, T1014)
This rule detects the 'Bring Your Own Vulnerable Driver' (BYOVD) technique by monitoring for the creation of new kernel-mode drivers in temporary locations (followed by an immediate registration as a service) that correlate with known vulnerable drivers. It checks file system events for driver drops and links them to service installation events (EventCode 7045) within a 5-minute window.
Splunk (SPL)
