Kernel Callback Registration Abuse via Suspicious Driver Registration

Renata Cardoso@rcardososec

•updated Jul 1, 2026•0•0•3

This rule monitors for the creation of a new .sys file outside of the standard Windows system driver directories (System32 or SysWOW64) within a 15-minute window of a corresponding registry update to the 'ImagePath' of a service. This sequence is indicative of a persistence mechanism involving the installation of a potentially malicious kernel-mode driver, often used by rootkits or malware to achieve high-privilege execution.