Suspicious Driver Load and Kernel Modification Activity

Shadows VMB@Vemorian_Mort

•updated yesterday•1•1•3

This rule detects suspicious driver loading from user-writable paths, kernel driver service creation, disabling of driver signing, loading of Linux kernel modules, and the usage of LD_PRELOAD for rootkit functionality.