SSDT Hooking via Kernel Driver Service Registration Outside System32

Renata Cardoso@rcardososec

•updated Jul 1, 2026•0•0•4

Detects the creation or modification of Windows kernel-mode services using the sc.exe utility when the process is not initiated by the legitimate service control manager (services.exe). This behavior is often associated with the loading of malicious drivers or rootkits, which may attempt to bypass standard service management processes to maintain persistence or elevate privileges.