Kernel-driver service lifecycle full stop→poll→delete→re-drop sequence for drvsvc/drv.sys

Duo Tech@duotech

•updated Aug 4, 2026•0•0•4

Detects a full defense-evasion sequence against the drvsvc kernel service and its drv.sys driver: stop, poll, delete, and re-drop occurring within a short time window.