Rare Driver Load and Defense Tampering Sequence
Detects a sequence of events indicative of Bring Your Own Vulnerable Driver (BYOVD) attacks or security control impairment. It monitors for the loading of a rare driver (seen on 3 or fewer hosts), accompanied by either the creation of a kernel service or defense tampering activities such as disabling security monitoring or stopping security-related services.
CQL
