DKOM EPROCESS Manipulation via Out-of-Path Kernel Driver Load

Renata Cardoso@rcardososec

•updated Jul 1, 2026•0•0•3

Detects the creation of a kernel service pointing to a .sys file located outside the standard Windows system driver directory. This pattern is indicative of a kernel driver being dropped and registered for persistence, a common step in the installation of rootkits or malicious kernel-mode drivers.