Kernel driver service creation for Phantom Mantis EDR-killer (drvsvc/'a' loading drv.sys)

Ethan Andrews@eandrews

•updated Aug 4, 2026•2•0•2

Detects the creation of kernel-mode driver services associated with the Phantom Mantis EDR-killer (LARVA-368). The rule monitors for registry modifications to service ImagePath values containing 'drv.sys' for services named 'drvsvc' or 'a', and tracks command-line executions of 'sc.exe' attempting to create kernel services with those same names or paths, indicating unauthorized kernel-mode code execution attempts for security software suppression.