Kernel Driver Load via sc.exe or Registry Services Key (.sys ImagePath)

Renata Cardoso@rcardososec

•updated Jul 1, 2026•0•0•5

This rule detects the installation or modification of kernel-mode drivers on Windows systems. It identifies potential driver installation activities using 'sc.exe' to create a service with a kernel-type driver image, or by monitoring Registry 'ImagePath' updates for services that point to '.sys' files, a common method for rootkit or malicious driver persistence.