DKOM Kernel Driver Hidden via PsLoadedModuleList Unlinking - Rootkit Precursor

Renata Cardoso@rcardososec

•updated Jul 1, 2026•0•0•8

This rule detects the creation of a new .sys driver file outside of standard Windows system directories (System32/drivers, DriverStore, SysWOW64/drivers) followed by the registration or modification of a service in the Windows Registry (CurrentControlSet/Services) within 15 minutes. This pattern is indicative of potential unauthorized driver installation or a Bring Your Own Vulnerable Driver (BYOVD) attack.