Lunex BYOVD: curl symbol-server spoof and random .sys drop to Temp/Public
This rule detects a sequence of suspicious activities indicative of malicious driver installation. It identifies the creation of an irregularly named .sys file in temp directories, the use of curl.exe to retrieve symbols for a potentially malicious driver, and the subsequent registration/start of that driver as a Windows system service.
Microsoft Sentinel (KQL)
