BYOVD abused vulnerable driver load or driver load from user-writable path
Detects the loading of known vulnerable drivers (often used in Bring Your Own Vulnerable Driver attacks) or drivers loaded from user-writable paths outside of trusted directories.
Microsoft Sentinel (KQL)
