gbbsym.exe/symgooq.exe kernel callback listing and removal via vulnerable driver
Detects a sequence of events where a known vulnerable driver is dropped or modified on a device, followed shortly by the execution of a specific callback tool (such as gbbsym.exe or symgooq.exe) or a tool matching known hashes, often associated with Bring Your Own Vulnerable Driver (BYOVD) tactics.
Microsoft Sentinel (KQL)
