BYOVD EDR Neutralization via eb.sys (GentleKiller) Driver
This rule detects the loading of a driver named 'eb.sys' (or matching a specific SHA256 hash) paired with the creation of a Windows service for that driver via the 'sc' command. This behavior is indicative of potential rootkit installation or driver-based persistence mechanisms.
Microsoft Sentinel (KQL)
